From af48fd85489a8fe4eb3925cbc6c33001aa90e66d Mon Sep 17 00:00:00 2001 From: Alex Khakhlyuk Date: Fri, 4 Sep 2026 15:09:35 +0000 Subject: [PATCH 1/5] Add direct-mode bundle support for AI Gateway model_provider_service Third and last of the stacked split of #6410 (stacked on the mcp_service PR). Direct engine only; provider_type is immutable (recreate) and write-only provider secrets + server-computed fields are suppressed to avoid phantom drift. Co-authored-by: Isaac --- .../ai-gateway-model-provider-service.md | 1 + .../model_provider_service/databricks.yml | 16 + .../bind/model_provider_service/out.test.toml | 3 + .../bind/model_provider_service/output.txt | 30 + .../bind/model_provider_service/script | 5 + .../bind/model_provider_service/test.toml | 18 + .../configs/model_provider_service.yml.tmpl | 20 + .../databricks.yml | 17 + .../mutators.py | 16 + .../out.test.toml | 4 + .../output.txt | 28 + .../resources.py | 16 + .../model_provider_services-support/script | 5 + .../model_provider_services-support/test.toml | 4 + acceptance/bundle/refschema/out.fields.txt | 90 +++ .../basic/databricks.yml | 20 + .../basic/out.test.toml | 3 + .../model_provider_services/basic/output.txt | 149 ++++ .../model_provider_services/basic/script | 29 + .../model_provider_services/basic/test.toml | 7 + .../lifecycle/databricks.yml.tmpl | 19 + .../lifecycle/out.test.toml | 3 + .../lifecycle/output.txt | 23 + .../model_provider_services/lifecycle/script | 17 + .../lifecycle/test.toml | 9 + .../remote-delete/databricks.yml | 20 + .../remote-delete/out.test.toml | 3 + .../remote-delete/output.txt | 20 + .../remote-delete/script | 9 + .../remote-delete/test.toml | 9 + .../model_provider_services/test.toml | 7 + acceptance/experimental/open/output.txt | 3 +- .../apply_bundle_permissions_test.go | 1 + .../resourcemutator/apply_target_mode_test.go | 3 + .../capture_uc_dependencies.go | 6 + .../capture_uc_dependencies_test.go | 8 + .../mutator/resourcemutator/run_as_test.go | 2 + bundle/config/resources.go | 3 + .../resources/model_provider_service.go | 104 +++ bundle/config/resources_test.go | 6 + bundle/deploy/terraform/lifecycle_test.go | 1 + bundle/direct/dresources/all.go | 1 + bundle/direct/dresources/all_test.go | 8 + .../direct/dresources/apitypes.generated.yml | 2 + .../dresources/model_provider_service.go | 139 ++++ bundle/internal/schema/annotations.yml | 19 + .../validation/generated/enum_fields.go | 27 +- .../validation/generated/required_fields.go | 8 + bundle/schema/jsonschema.json | 672 ++++++++++++++++++ bundle/statemgmt/state_load_test.go | 35 + cmd/experimental/workspace_open_test.go | 5 +- libs/testserver/fake_workspace.go | 40 +- libs/testserver/handlers.go | 18 + libs/testserver/model_provider_services.go | 70 ++ libs/workspaceurls/urls.go | 22 +- python/databricks/bundles/core/__init__.py | 2 + .../bundles/core/_generated/__init__.py | 8 + .../_generated/model_provider_services.py | 130 ++++ .../model_provider_services/__init__.py | 230 ++++++ .../_models/inference_table_config.py | 104 +++ .../_models/lifecycle.py | 40 ++ .../_models/model_provider_service.py | 59 ++ .../_models/model_provider_service_config.py | 376 ++++++++++ ...e_config_amazon_bedrock_provider_config.py | 77 ++ ...g_amazon_bedrock_provider_direct_config.py | 120 ++++ ...ervice_config_anthropic_provider_config.py | 90 +++ ...config_anthropic_provider_direct_config.py | 61 ++ ...onfig_anthropic_provider_relayed_config.py | 69 ++ ...ayed_config_anthropic_relayed_plan_type.py | 29 + ..._provider_service_config_aws_access_key.py | 76 ++ ...ce_config_azure_open_ai_provider_config.py | 81 +++ ...ig_azure_open_ai_provider_direct_config.py | 152 ++++ ...r_service_config_custom_provider_config.py | 75 ++ ...ce_config_custom_provider_direct_config.py | 83 +++ ..._service_config_entra_service_principal.py | 89 +++ ...ice_config_external_model_provider_type.py | 40 ++ ...onfig_gemini_enterprise_provider_config.py | 71 ++ ...emini_enterprise_provider_direct_config.py | 98 +++ ...onfig_microsoft_foundry_provider_config.py | 91 +++ ...icrosoft_foundry_provider_direct_config.py | 154 ++++ ...ider_service_config_model_target_config.py | 79 ++ ..._service_config_open_ai_provider_config.py | 59 ++ ...e_config_open_ai_provider_direct_config.py | 89 +++ ...provider_service_config_provider_secret.py | 56 ++ ...vider_service_config_service_credential.py | 59 ++ .../_models/rate_limit.py | 154 ++++ .../_models/rate_limit_rate_limit_key.py | 30 + .../rate_limit_rate_limit_renewal_period.py | 19 + .../core/_generated/__init__.py | 2 + .../_generated/model_provider_services.py | 34 + python/databricks_tests/core/public_api.txt | 8 + 91 files changed, 4774 insertions(+), 43 deletions(-) create mode 100644 .nextchanges/bundles/ai-gateway-model-provider-service.md create mode 100644 acceptance/bundle/deployment/bind/model_provider_service/databricks.yml create mode 100644 acceptance/bundle/deployment/bind/model_provider_service/out.test.toml create mode 100644 acceptance/bundle/deployment/bind/model_provider_service/output.txt create mode 100644 acceptance/bundle/deployment/bind/model_provider_service/script create mode 100644 acceptance/bundle/deployment/bind/model_provider_service/test.toml create mode 100644 acceptance/bundle/invariant/configs/model_provider_service.yml.tmpl create mode 100644 acceptance/bundle/python/model_provider_services-support/databricks.yml create mode 100644 acceptance/bundle/python/model_provider_services-support/mutators.py create mode 100644 acceptance/bundle/python/model_provider_services-support/out.test.toml create mode 100644 acceptance/bundle/python/model_provider_services-support/output.txt create mode 100644 acceptance/bundle/python/model_provider_services-support/resources.py create mode 100644 acceptance/bundle/python/model_provider_services-support/script create mode 100644 acceptance/bundle/python/model_provider_services-support/test.toml create mode 100644 acceptance/bundle/resources/model_provider_services/basic/databricks.yml create mode 100644 acceptance/bundle/resources/model_provider_services/basic/out.test.toml create mode 100644 acceptance/bundle/resources/model_provider_services/basic/output.txt create mode 100644 acceptance/bundle/resources/model_provider_services/basic/script create mode 100644 acceptance/bundle/resources/model_provider_services/basic/test.toml create mode 100644 acceptance/bundle/resources/model_provider_services/lifecycle/databricks.yml.tmpl create mode 100644 acceptance/bundle/resources/model_provider_services/lifecycle/out.test.toml create mode 100644 acceptance/bundle/resources/model_provider_services/lifecycle/output.txt create mode 100644 acceptance/bundle/resources/model_provider_services/lifecycle/script create mode 100644 acceptance/bundle/resources/model_provider_services/lifecycle/test.toml create mode 100644 acceptance/bundle/resources/model_provider_services/remote-delete/databricks.yml create mode 100644 acceptance/bundle/resources/model_provider_services/remote-delete/out.test.toml create mode 100644 acceptance/bundle/resources/model_provider_services/remote-delete/output.txt create mode 100644 acceptance/bundle/resources/model_provider_services/remote-delete/script create mode 100644 acceptance/bundle/resources/model_provider_services/remote-delete/test.toml create mode 100644 acceptance/bundle/resources/model_provider_services/test.toml create mode 100644 bundle/config/resources/model_provider_service.go create mode 100644 bundle/direct/dresources/model_provider_service.go create mode 100644 libs/testserver/model_provider_services.go create mode 100644 python/databricks/bundles/core/_generated/model_provider_services.py create mode 100644 python/databricks/bundles/model_provider_services/__init__.py create mode 100644 python/databricks/bundles/model_provider_services/_models/inference_table_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/lifecycle.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_direct_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_direct_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config_anthropic_relayed_plan_type.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_aws_access_key.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_direct_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_direct_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_entra_service_principal.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_external_model_provider_type.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_direct_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_direct_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_model_target_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_direct_config.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_secret.py create mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_service_credential.py create mode 100644 python/databricks/bundles/model_provider_services/_models/rate_limit.py create mode 100644 python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_key.py create mode 100644 python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_renewal_period.py create mode 100644 python/databricks_tests/core/_generated/model_provider_services.py diff --git a/.nextchanges/bundles/ai-gateway-model-provider-service.md b/.nextchanges/bundles/ai-gateway-model-provider-service.md new file mode 100644 index 00000000000..349334fc407 --- /dev/null +++ b/.nextchanges/bundles/ai-gateway-model-provider-service.md @@ -0,0 +1 @@ +* Add bundle support for the AI Gateway `model_provider_service` resource (direct engine). ([#6634](https://github.com/databricks/cli/pull/6634)) diff --git a/acceptance/bundle/deployment/bind/model_provider_service/databricks.yml b/acceptance/bundle/deployment/bind/model_provider_service/databricks.yml new file mode 100644 index 00000000000..18717f5715e --- /dev/null +++ b/acceptance/bundle/deployment/bind/model_provider_service/databricks.yml @@ -0,0 +1,16 @@ +bundle: + name: test-bundle + +resources: + model_provider_services: + mps1: + parent: schemas/main.myschema + model_provider_service_id: mysvc + comment: bound service + config: + provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM + custom: + direct: + base_url: https://api.example.com/v1 + api_key: + plaintext: dummy-api-key diff --git a/acceptance/bundle/deployment/bind/model_provider_service/out.test.toml b/acceptance/bundle/deployment/bind/model_provider_service/out.test.toml new file mode 100644 index 00000000000..27ec2a7fcd6 --- /dev/null +++ b/acceptance/bundle/deployment/bind/model_provider_service/out.test.toml @@ -0,0 +1,3 @@ +Cloud = false +EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"] +EnvMatrix.DMS = [""] diff --git a/acceptance/bundle/deployment/bind/model_provider_service/output.txt b/acceptance/bundle/deployment/bind/model_provider_service/output.txt new file mode 100644 index 00000000000..cafdcf3d28b --- /dev/null +++ b/acceptance/bundle/deployment/bind/model_provider_service/output.txt @@ -0,0 +1,30 @@ + +>>> [CLI] bundle deployment bind mps1 main.myschema.mysvc --auto-approve +Successfully bound model_provider_service with an id 'main.myschema.mysvc' +Run 'bundle deploy' to deploy changes to your workspace + +>>> [CLI] bundle summary +Name: test-bundle +Target: default +Workspace: + User: [USERNAME] + Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default +Resources: + Model provider services: + mps1: + Name: mysvc + URL: [DATABRICKS_URL]/explore/data/model-provider-services/main/myschema/mysvc?w=[NUMID] + +>>> [CLI] bundle deployment unbind mps1 + +>>> [CLI] bundle summary +Name: test-bundle +Target: default +Workspace: + User: [USERNAME] + Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default +Resources: + Model provider services: + mps1: + Name: mysvc + URL: (not deployed) diff --git a/acceptance/bundle/deployment/bind/model_provider_service/script b/acceptance/bundle/deployment/bind/model_provider_service/script new file mode 100644 index 00000000000..c003c48256c --- /dev/null +++ b/acceptance/bundle/deployment/bind/model_provider_service/script @@ -0,0 +1,5 @@ +trace $CLI bundle deployment bind mps1 main.myschema.mysvc --auto-approve +trace $CLI bundle summary + +trace $CLI bundle deployment unbind mps1 +trace $CLI bundle summary diff --git a/acceptance/bundle/deployment/bind/model_provider_service/test.toml b/acceptance/bundle/deployment/bind/model_provider_service/test.toml new file mode 100644 index 00000000000..651520efa8f --- /dev/null +++ b/acceptance/bundle/deployment/bind/model_provider_service/test.toml @@ -0,0 +1,18 @@ +# AI Gateway securables are direct-engine only. +EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"] + +Cloud = false + +Ignore = [ + ".databricks", +] + +# The bind flow issues a GET to confirm the remote resource exists before binding. +[[Server]] +Pattern = "GET /api/2.1/unity-catalog/model-provider-services/{name}" +Response.Body = ''' +{ + "name": "model-provider-services/main.myschema.mysvc", + "comment": "bound service" +} +''' diff --git a/acceptance/bundle/invariant/configs/model_provider_service.yml.tmpl b/acceptance/bundle/invariant/configs/model_provider_service.yml.tmpl new file mode 100644 index 00000000000..2c7b0910021 --- /dev/null +++ b/acceptance/bundle/invariant/configs/model_provider_service.yml.tmpl @@ -0,0 +1,20 @@ +bundle: + name: test-bundle-$UNIQUE_NAME + +resources: + model_provider_services: + foo: + parent: schemas/main.default + model_provider_service_id: test-model-provider-service-$UNIQUE_NAME + comment: test model provider service + config: + provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM + targets: + - model: gpt-4o + native_api_types: + - openai/v1/chat/completions + custom: + direct: + base_url: https://api.example.com/v1 + api_key: + plaintext: dummy-api-key diff --git a/acceptance/bundle/python/model_provider_services-support/databricks.yml b/acceptance/bundle/python/model_provider_services-support/databricks.yml new file mode 100644 index 00000000000..ef383951e01 --- /dev/null +++ b/acceptance/bundle/python/model_provider_services-support/databricks.yml @@ -0,0 +1,17 @@ +bundle: + name: my_project + +sync: {paths: []} # don't need to copy files + +python: + resources: + - "resources:load_resources" + mutators: + - "mutators:update_model_provider_service" + +resources: + model_provider_services: + my_model_provider_service_1: + parent: "schemas/main.default" + model_provider_service_id: "my_model_provider_service_1" + comment: "My model provider service" diff --git a/acceptance/bundle/python/model_provider_services-support/mutators.py b/acceptance/bundle/python/model_provider_services-support/mutators.py new file mode 100644 index 00000000000..03b76e35a46 --- /dev/null +++ b/acceptance/bundle/python/model_provider_services-support/mutators.py @@ -0,0 +1,16 @@ +from dataclasses import replace + +from databricks.bundles.model_provider_services import ModelProviderService +from databricks.bundles.core import model_provider_service_mutator + + +@model_provider_service_mutator +def update_model_provider_service( + model_provider_service: ModelProviderService, +) -> ModelProviderService: + assert isinstance(model_provider_service.comment, str) + + return replace( + model_provider_service, + comment=f"{model_provider_service.comment} (updated)", + ) diff --git a/acceptance/bundle/python/model_provider_services-support/out.test.toml b/acceptance/bundle/python/model_provider_services-support/out.test.toml new file mode 100644 index 00000000000..02da5baab89 --- /dev/null +++ b/acceptance/bundle/python/model_provider_services-support/out.test.toml @@ -0,0 +1,4 @@ +Cloud = false +EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"] +EnvMatrix.DMS = ["", "true"] +EnvMatrix.PYDAB_VERSION = ["current"] diff --git a/acceptance/bundle/python/model_provider_services-support/output.txt b/acceptance/bundle/python/model_provider_services-support/output.txt new file mode 100644 index 00000000000..b3f971b560a --- /dev/null +++ b/acceptance/bundle/python/model_provider_services-support/output.txt @@ -0,0 +1,28 @@ + +>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json +{ + "experimental": { + "python": { + "mutators": [ + "mutators:update_model_provider_service" + ], + "resources": [ + "resources:load_resources" + ] + } + }, + "resources": { + "model_provider_services": { + "my_model_provider_service_1": { + "comment": "My model provider service (updated)", + "model_provider_service_id": "my_model_provider_service_1", + "parent": "schemas/main.default" + }, + "my_model_provider_service_2": { + "comment": "My model provider service (2) (updated)", + "model_provider_service_id": "my_model_provider_service_2", + "parent": "schemas/main.default" + } + } + } +} diff --git a/acceptance/bundle/python/model_provider_services-support/resources.py b/acceptance/bundle/python/model_provider_services-support/resources.py new file mode 100644 index 00000000000..5dceaf37b68 --- /dev/null +++ b/acceptance/bundle/python/model_provider_services-support/resources.py @@ -0,0 +1,16 @@ +from databricks.bundles.core import Resources + + +def load_resources() -> Resources: + resources = Resources() + + resources.add_model_provider_service( + "my_model_provider_service_2", + { + "parent": "schemas/main.default", + "model_provider_service_id": "my_model_provider_service_2", + "comment": "My model provider service (2)", + }, + ) + + return resources diff --git a/acceptance/bundle/python/model_provider_services-support/script b/acceptance/bundle/python/model_provider_services-support/script new file mode 100644 index 00000000000..e273fb45a53 --- /dev/null +++ b/acceptance/bundle/python/model_provider_services-support/script @@ -0,0 +1,5 @@ + +trace uv run $UV_ARGS -q $CLI bundle validate --output json | \ + jq "pick(.experimental.python, .resources)" + +rm -fr .databricks __pycache__ diff --git a/acceptance/bundle/python/model_provider_services-support/test.toml b/acceptance/bundle/python/model_provider_services-support/test.toml new file mode 100644 index 00000000000..b9ab1057685 --- /dev/null +++ b/acceptance/bundle/python/model_provider_services-support/test.toml @@ -0,0 +1,4 @@ +Cloud = false # tests don't interact with APIs + +# model_provider_services are only supported in the current version of the wheel +EnvMatrix.PYDAB_VERSION = ["current"] diff --git a/acceptance/bundle/refschema/out.fields.txt b/acceptance/bundle/refschema/out.fields.txt index 750445182bd..8f4cd995787 100644 --- a/acceptance/bundle/refschema/out.fields.txt +++ b/acceptance/bundle/refschema/out.fields.txt @@ -2103,6 +2103,96 @@ resources.mcp_services.*.mcp_service_id string ALL resources.mcp_services.*.modified_status string INPUT resources.mcp_services.*.parent string ALL resources.mcp_services.*.url string INPUT +resources.model_provider_services.*.comment string ALL +resources.model_provider_services.*.config *catalog.ModelProviderServiceConfig ALL +resources.model_provider_services.*.config.allow_all_targets bool ALL +resources.model_provider_services.*.config.amazon_bedrock *catalog.ModelProviderServiceConfigAmazonBedrockProviderConfig ALL +resources.model_provider_services.*.config.amazon_bedrock.direct *catalog.ModelProviderServiceConfigAmazonBedrockProviderDirectConfig ALL +resources.model_provider_services.*.config.amazon_bedrock.direct.aws_access_key *catalog.ModelProviderServiceConfigAwsAccessKey ALL +resources.model_provider_services.*.config.amazon_bedrock.direct.aws_access_key.access_key_id string ALL +resources.model_provider_services.*.config.amazon_bedrock.direct.aws_access_key.secret_access_key *catalog.ModelProviderServiceConfigProviderSecret ALL +resources.model_provider_services.*.config.amazon_bedrock.direct.aws_access_key.secret_access_key.plaintext string ALL +resources.model_provider_services.*.config.amazon_bedrock.direct.region string ALL +resources.model_provider_services.*.config.amazon_bedrock.direct.service_credential *catalog.ModelProviderServiceConfigServiceCredential ALL +resources.model_provider_services.*.config.amazon_bedrock.direct.service_credential.name string ALL +resources.model_provider_services.*.config.anthropic *catalog.ModelProviderServiceConfigAnthropicProviderConfig ALL +resources.model_provider_services.*.config.anthropic.direct *catalog.ModelProviderServiceConfigAnthropicProviderDirectConfig ALL +resources.model_provider_services.*.config.anthropic.direct.api_key *catalog.ModelProviderServiceConfigProviderSecret ALL +resources.model_provider_services.*.config.anthropic.direct.api_key.plaintext string ALL +resources.model_provider_services.*.config.anthropic.relayed *catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfig ALL +resources.model_provider_services.*.config.anthropic.relayed.plan_type catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType ALL +resources.model_provider_services.*.config.azure_openai *catalog.ModelProviderServiceConfigAzureOpenAiProviderConfig ALL +resources.model_provider_services.*.config.azure_openai.direct *catalog.ModelProviderServiceConfigAzureOpenAiProviderDirectConfig ALL +resources.model_provider_services.*.config.azure_openai.direct.api_key *catalog.ModelProviderServiceConfigProviderSecret ALL +resources.model_provider_services.*.config.azure_openai.direct.api_key.plaintext string ALL +resources.model_provider_services.*.config.azure_openai.direct.base_url string ALL +resources.model_provider_services.*.config.azure_openai.direct.entra_service_principal *catalog.ModelProviderServiceConfigEntraServicePrincipal ALL +resources.model_provider_services.*.config.azure_openai.direct.entra_service_principal.client_id string ALL +resources.model_provider_services.*.config.azure_openai.direct.entra_service_principal.client_secret *catalog.ModelProviderServiceConfigProviderSecret ALL +resources.model_provider_services.*.config.azure_openai.direct.entra_service_principal.client_secret.plaintext string ALL +resources.model_provider_services.*.config.azure_openai.direct.entra_service_principal.tenant_id string ALL +resources.model_provider_services.*.config.azure_openai.direct.service_credential *catalog.ModelProviderServiceConfigServiceCredential ALL +resources.model_provider_services.*.config.azure_openai.direct.service_credential.name string ALL +resources.model_provider_services.*.config.custom *catalog.ModelProviderServiceConfigCustomProviderConfig ALL +resources.model_provider_services.*.config.custom.direct *catalog.ModelProviderServiceConfigCustomProviderDirectConfig ALL +resources.model_provider_services.*.config.custom.direct.api_key *catalog.ModelProviderServiceConfigProviderSecret ALL +resources.model_provider_services.*.config.custom.direct.api_key.plaintext string ALL +resources.model_provider_services.*.config.custom.direct.base_url string ALL +resources.model_provider_services.*.config.forward_headers bool ALL +resources.model_provider_services.*.config.forward_query_parameters bool ALL +resources.model_provider_services.*.config.forward_unmanaged_paths bool ALL +resources.model_provider_services.*.config.gemini_enterprise *catalog.ModelProviderServiceConfigGeminiEnterpriseProviderConfig ALL +resources.model_provider_services.*.config.gemini_enterprise.direct *catalog.ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig ALL +resources.model_provider_services.*.config.gemini_enterprise.direct.api_key *catalog.ModelProviderServiceConfigProviderSecret ALL +resources.model_provider_services.*.config.gemini_enterprise.direct.api_key.plaintext string ALL +resources.model_provider_services.*.config.gemini_enterprise.direct.project_id string ALL +resources.model_provider_services.*.config.gemini_enterprise.direct.region string ALL +resources.model_provider_services.*.config.inference_table *catalog.InferenceTableConfig ALL +resources.model_provider_services.*.config.inference_table.disabled bool ALL +resources.model_provider_services.*.config.inference_table.is_deleted bool ALL +resources.model_provider_services.*.config.inference_table.parent string ALL +resources.model_provider_services.*.config.inference_table.table string ALL +resources.model_provider_services.*.config.inference_table.table_name_prefix string ALL +resources.model_provider_services.*.config.microsoft_foundry *catalog.ModelProviderServiceConfigMicrosoftFoundryProviderConfig ALL +resources.model_provider_services.*.config.microsoft_foundry.direct *catalog.ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig ALL +resources.model_provider_services.*.config.microsoft_foundry.direct.api_key *catalog.ModelProviderServiceConfigProviderSecret ALL +resources.model_provider_services.*.config.microsoft_foundry.direct.api_key.plaintext string ALL +resources.model_provider_services.*.config.microsoft_foundry.direct.base_url string ALL +resources.model_provider_services.*.config.microsoft_foundry.direct.entra_service_principal *catalog.ModelProviderServiceConfigEntraServicePrincipal ALL +resources.model_provider_services.*.config.microsoft_foundry.direct.entra_service_principal.client_id string ALL +resources.model_provider_services.*.config.microsoft_foundry.direct.entra_service_principal.client_secret *catalog.ModelProviderServiceConfigProviderSecret ALL +resources.model_provider_services.*.config.microsoft_foundry.direct.entra_service_principal.client_secret.plaintext string ALL +resources.model_provider_services.*.config.microsoft_foundry.direct.entra_service_principal.tenant_id string ALL +resources.model_provider_services.*.config.microsoft_foundry.direct.service_credential *catalog.ModelProviderServiceConfigServiceCredential ALL +resources.model_provider_services.*.config.microsoft_foundry.direct.service_credential.name string ALL +resources.model_provider_services.*.config.openai *catalog.ModelProviderServiceConfigOpenAiProviderConfig ALL +resources.model_provider_services.*.config.openai.direct *catalog.ModelProviderServiceConfigOpenAiProviderDirectConfig ALL +resources.model_provider_services.*.config.openai.direct.api_key *catalog.ModelProviderServiceConfigProviderSecret ALL +resources.model_provider_services.*.config.openai.direct.api_key.plaintext string ALL +resources.model_provider_services.*.config.openai.direct.base_url string ALL +resources.model_provider_services.*.config.openai.direct.organization string ALL +resources.model_provider_services.*.config.provider_type catalog.ModelProviderServiceConfigExternalModelProviderType ALL +resources.model_provider_services.*.config.rate_limits []catalog.RateLimit ALL +resources.model_provider_services.*.config.rate_limits[*] catalog.RateLimit ALL +resources.model_provider_services.*.config.rate_limits[*].key catalog.RateLimitRateLimitKey ALL +resources.model_provider_services.*.config.rate_limits[*].principal string ALL +resources.model_provider_services.*.config.rate_limits[*].renewal_period catalog.RateLimitRateLimitRenewalPeriod ALL +resources.model_provider_services.*.config.rate_limits[*].request_tag_key string ALL +resources.model_provider_services.*.config.rate_limits[*].request_tag_value string ALL +resources.model_provider_services.*.config.rate_limits[*].requests int64 ALL +resources.model_provider_services.*.config.rate_limits[*].tokens int64 ALL +resources.model_provider_services.*.config.targets []catalog.ModelProviderServiceConfigModelTargetConfig ALL +resources.model_provider_services.*.config.targets[*] catalog.ModelProviderServiceConfigModelTargetConfig ALL +resources.model_provider_services.*.config.targets[*].model string ALL +resources.model_provider_services.*.config.targets[*].native_api_types []string ALL +resources.model_provider_services.*.config.targets[*].native_api_types[*] string ALL +resources.model_provider_services.*.id string INPUT +resources.model_provider_services.*.lifecycle resources.Lifecycle INPUT +resources.model_provider_services.*.lifecycle.prevent_destroy bool INPUT +resources.model_provider_services.*.model_provider_service_id string ALL +resources.model_provider_services.*.modified_status string INPUT +resources.model_provider_services.*.parent string ALL +resources.model_provider_services.*.url string INPUT resources.model_services.*.comment string ALL resources.model_services.*.config *catalog.ModelServiceConfig ALL resources.model_services.*.config.inference_table *catalog.InferenceTableConfig ALL diff --git a/acceptance/bundle/resources/model_provider_services/basic/databricks.yml b/acceptance/bundle/resources/model_provider_services/basic/databricks.yml new file mode 100644 index 00000000000..aeac81263d9 --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/basic/databricks.yml @@ -0,0 +1,20 @@ +bundle: + name: test-bundle + +resources: + model_provider_services: + mps1: + parent: schemas/main.myschema + model_provider_service_id: myservice + comment: COMMENT1 + config: + provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM + targets: + - model: gpt-4o + native_api_types: + - openai/v1/chat/completions + custom: + direct: + base_url: https://api.example.com/v1 + api_key: + plaintext: dummy-api-key diff --git a/acceptance/bundle/resources/model_provider_services/basic/out.test.toml b/acceptance/bundle/resources/model_provider_services/basic/out.test.toml new file mode 100644 index 00000000000..59b56a2037c --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/basic/out.test.toml @@ -0,0 +1,3 @@ +Cloud = false +EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"] +EnvMatrix.DMS = ["", "true"] diff --git a/acceptance/bundle/resources/model_provider_services/basic/output.txt b/acceptance/bundle/resources/model_provider_services/basic/output.txt new file mode 100644 index 00000000000..a3dfbff46fa --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/basic/output.txt @@ -0,0 +1,149 @@ + +=== Initial summary before deploy +>>> [CLI] bundle summary -o json +{ + "comment": "COMMENT1", + "config": { + "custom": { + "direct": { + "api_key": { + "plaintext": "dummy-api-key" + }, + "base_url": "https://api.example.com/v1" + } + }, + "provider_type": "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM", + "targets": [ + { + "model": "gpt-4o", + "native_api_types": [ + "openai/v1/chat/completions" + ] + } + ] + }, + "model_provider_service_id": "myservice", + "modified_status": "created", + "parent": "schemas/main.myschema" +} + +=== Verify it does not exist yet +>>> musterr [CLI] ai-gateway get-model-provider-service model-provider-services/main.myschema.myservice +Error: Resource catalog.ModelProviderService not found: main.myschema.myservice + +>>> [CLI] bundle deploy +Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files... +Created model_provider_services.mps1 +Files: 3 uploaded, 0 deleted +Resources: 1 created, 0 changed, 0 deleted, 0 unchanged + +>>> print_requests.py //unity +{ + "method": "POST", + "path": "/api/2.1/unity-catalog/model-provider-services", + "q": { + "model_provider_service_id": "myservice", + "parent": "schemas/main.myschema" + }, + "body": { + "comment": "COMMENT1", + "config": { + "custom": { + "direct": { + "api_key": { + "plaintext": "dummy-api-key" + }, + "base_url": "https://api.example.com/v1" + } + }, + "provider_type": "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM", + "targets": [ + { + "model": "gpt-4o", + "native_api_types": [ + "openai/v1/chat/completions" + ] + } + ] + } + } +} + +=== Summary should show the id and the Catalog Explorer url +>>> [CLI] bundle summary -o json +{ + "id": "main.myschema.myservice", + "url": "[DATABRICKS_URL]/explore/data/model-provider-services/main/myschema/myservice?w=[NUMID]" +} + +=== Verify deployment +>>> [CLI] ai-gateway get-model-provider-service model-provider-services/main.myschema.myservice +{ + "name": "model-provider-services/main.myschema.myservice", + "comment": "COMMENT1" +} + +=== Update comment (should update in place, not recreate) +>>> update_file.py databricks.yml COMMENT1 COMMENT2 + +>>> [CLI] bundle deploy +Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files... +Updated model_provider_services.mps1 +Files: 1 uploaded, 0 deleted +Resources: 0 created, 1 changed, 0 deleted, 0 unchanged + +>>> print_requests.py //unity +{ + "method": "PATCH", + "path": "/api/2.1/unity-catalog/model-provider-services/main.myschema.myservice", + "q": { + "update_mask": "*" + }, + "body": { + "comment": "COMMENT2", + "config": { + "custom": { + "direct": { + "api_key": { + "plaintext": "dummy-api-key" + }, + "base_url": "https://api.example.com/v1" + } + }, + "provider_type": "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM", + "targets": [ + { + "model": "gpt-4o", + "native_api_types": [ + "openai/v1/chat/completions" + ] + } + ] + } + } +} + +>>> [CLI] ai-gateway get-model-provider-service model-provider-services/main.myschema.myservice +"COMMENT2" + +=== Change an immutable field (should plan a recreate) +>>> update_file.py databricks.yml EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC + +>>> [CLI] bundle plan +recreate model_provider_services.mps1 + +Plan: 1 to add, 0 to change, 1 to delete, 0 unchanged + +>>> [CLI] bundle destroy --auto-approve +The following resources will be deleted: + delete resources.model_provider_services.mps1 + +All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default + +Destroy: 1 deleted + +>>> print_requests.py //unity +{ + "method": "DELETE", + "path": "/api/2.1/unity-catalog/model-provider-services/main.myschema.myservice" +} diff --git a/acceptance/bundle/resources/model_provider_services/basic/script b/acceptance/bundle/resources/model_provider_services/basic/script new file mode 100644 index 00000000000..f12527b141d --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/basic/script @@ -0,0 +1,29 @@ +title "Initial summary before deploy" +trace $CLI bundle summary -o json | jq .resources.model_provider_services.mps1 + +title "Verify it does not exist yet" +trace musterr $CLI ai-gateway get-model-provider-service model-provider-services/main.myschema.myservice + +trace $CLI bundle deploy +trace print_requests.py //unity + +title "Summary should show the id and the Catalog Explorer url" +trace $CLI bundle summary -o json | jq ".resources.model_provider_services.mps1 | {id, url}" + +title "Verify deployment" +trace $CLI ai-gateway get-model-provider-service model-provider-services/main.myschema.myservice | jq '{name, comment}' + +title "Update comment (should update in place, not recreate)" +trace update_file.py databricks.yml COMMENT1 COMMENT2 +trace $CLI bundle deploy +trace print_requests.py //unity +trace $CLI ai-gateway get-model-provider-service model-provider-services/main.myschema.myservice | jq .comment + +title "Change an immutable field (should plan a recreate)" +trace update_file.py databricks.yml EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC +trace $CLI bundle plan + +trace $CLI bundle destroy --auto-approve +trace print_requests.py //unity + +rm -f out.requests.txt diff --git a/acceptance/bundle/resources/model_provider_services/basic/test.toml b/acceptance/bundle/resources/model_provider_services/basic/test.toml new file mode 100644 index 00000000000..116f2013783 --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/basic/test.toml @@ -0,0 +1,7 @@ +# Local only: this test inspects the recorded request stream (print_requests), +# which has no equivalent against a real workspace. +Cloud = false + +Ignore = [ + ".databricks", +] diff --git a/acceptance/bundle/resources/model_provider_services/lifecycle/databricks.yml.tmpl b/acceptance/bundle/resources/model_provider_services/lifecycle/databricks.yml.tmpl new file mode 100644 index 00000000000..c7e4a7552c7 --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/lifecycle/databricks.yml.tmpl @@ -0,0 +1,19 @@ +bundle: + name: deploy-model-provider-service-test-$UNIQUE_NAME + +resources: + model_provider_services: + mps: + parent: schemas/main.default + model_provider_service_id: test_mps_$UNIQUE_NAME + comment: "Routes to a custom OpenAI-compatible provider" + config: + provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM + targets: + - model: gpt-4o + native_api_types: ["openai/v1/chat/completions"] + custom: + direct: + base_url: https://api.example.com/v1 + api_key: + plaintext: dummy-api-key diff --git a/acceptance/bundle/resources/model_provider_services/lifecycle/out.test.toml b/acceptance/bundle/resources/model_provider_services/lifecycle/out.test.toml new file mode 100644 index 00000000000..ae5c7bd798f --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/lifecycle/out.test.toml @@ -0,0 +1,3 @@ +Cloud = true +EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"] +EnvMatrix.DMS = ["", "true"] diff --git a/acceptance/bundle/resources/model_provider_services/lifecycle/output.txt b/acceptance/bundle/resources/model_provider_services/lifecycle/output.txt new file mode 100644 index 00000000000..7ed3ee78137 --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/lifecycle/output.txt @@ -0,0 +1,23 @@ + +>>> [CLI] bundle deploy +Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-model-provider-service-test-[UNIQUE_NAME]/default/files... +Created model_provider_services.mps +Files: 4 uploaded, 0 deleted +Resources: 1 created, 0 changed, 0 deleted, 0 unchanged + +>>> [CLI] ai-gateway get-model-provider-service model-provider-services/main.default.test_mps_[UNIQUE_NAME] +{ + "name": "model-provider-services/main.default.test_mps_[UNIQUE_NAME]", + "comment": "Routes to a custom OpenAI-compatible provider" +} + +>>> [CLI] bundle plan +Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged + +>>> [CLI] bundle destroy --auto-approve +The following resources will be deleted: + delete resources.model_provider_services.mps + +All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-model-provider-service-test-[UNIQUE_NAME]/default + +Destroy: 1 deleted diff --git a/acceptance/bundle/resources/model_provider_services/lifecycle/script b/acceptance/bundle/resources/model_provider_services/lifecycle/script new file mode 100644 index 00000000000..634183f4759 --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/lifecycle/script @@ -0,0 +1,17 @@ +envsubst < databricks.yml.tmpl > databricks.yml + +cleanup() { + trace $CLI bundle destroy --auto-approve +} +trap cleanup EXIT + +trace $CLI bundle deploy + +MPS_ID=$($CLI bundle summary --output json | jq -r '.resources.model_provider_services.mps.id') + +trace $CLI ai-gateway get-model-provider-service "model-provider-services/$MPS_ID" | jq '{name, comment}' + +# Verify there is no drift right after deploy. Text plan (not -o json) keeps the +# output identical between the mock and a real workspace: the server populates +# output-only fields but the resource action stays "unchanged". +trace $CLI bundle plan diff --git a/acceptance/bundle/resources/model_provider_services/lifecycle/test.toml b/acceptance/bundle/resources/model_provider_services/lifecycle/test.toml new file mode 100644 index 00000000000..68085ea7337 --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/lifecycle/test.toml @@ -0,0 +1,9 @@ +# Model provider service lifecycle also runs against a real workspace. It uses a +# custom OpenAI-compatible provider with placeholder base_url/api_key, the +# smallest config the backend accepts (it cannot be created with only a comment). +RecordRequests = false + +Ignore = [ + "databricks.yml", + ".databricks", +] diff --git a/acceptance/bundle/resources/model_provider_services/remote-delete/databricks.yml b/acceptance/bundle/resources/model_provider_services/remote-delete/databricks.yml new file mode 100644 index 00000000000..aeac81263d9 --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/remote-delete/databricks.yml @@ -0,0 +1,20 @@ +bundle: + name: test-bundle + +resources: + model_provider_services: + mps1: + parent: schemas/main.myschema + model_provider_service_id: myservice + comment: COMMENT1 + config: + provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM + targets: + - model: gpt-4o + native_api_types: + - openai/v1/chat/completions + custom: + direct: + base_url: https://api.example.com/v1 + api_key: + plaintext: dummy-api-key diff --git a/acceptance/bundle/resources/model_provider_services/remote-delete/out.test.toml b/acceptance/bundle/resources/model_provider_services/remote-delete/out.test.toml new file mode 100644 index 00000000000..59b56a2037c --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/remote-delete/out.test.toml @@ -0,0 +1,3 @@ +Cloud = false +EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"] +EnvMatrix.DMS = ["", "true"] diff --git a/acceptance/bundle/resources/model_provider_services/remote-delete/output.txt b/acceptance/bundle/resources/model_provider_services/remote-delete/output.txt new file mode 100644 index 00000000000..3b2a33e3c02 --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/remote-delete/output.txt @@ -0,0 +1,20 @@ + +>>> [CLI] bundle deploy +Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files... +Created model_provider_services.mps1 +Files: 3 uploaded, 0 deleted +Resources: 1 created, 0 changed, 0 deleted, 0 unchanged + +=== Delete the resource out of band +>>> [CLI] ai-gateway delete-model-provider-service model-provider-services/main.myschema.myservice + +=== Plan should detect the resource is gone and re-create it +>>> [CLI] bundle plan +create model_provider_services.mps1 + +Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged + +>>> [CLI] bundle destroy --auto-approve +All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default + +Destroy: 0 deleted diff --git a/acceptance/bundle/resources/model_provider_services/remote-delete/script b/acceptance/bundle/resources/model_provider_services/remote-delete/script new file mode 100644 index 00000000000..e7377733cc6 --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/remote-delete/script @@ -0,0 +1,9 @@ +trace $CLI bundle deploy + +title "Delete the resource out of band" +trace $CLI ai-gateway delete-model-provider-service model-provider-services/main.myschema.myservice + +title "Plan should detect the resource is gone and re-create it" +trace $CLI bundle plan + +trace $CLI bundle destroy --auto-approve diff --git a/acceptance/bundle/resources/model_provider_services/remote-delete/test.toml b/acceptance/bundle/resources/model_provider_services/remote-delete/test.toml new file mode 100644 index 00000000000..074377ab341 --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/remote-delete/test.toml @@ -0,0 +1,9 @@ +# Local only: simulates an out-of-band delete with a fixed resource name and no +# cloud-valid config, so it can't run against a real workspace. +Cloud = false + +RecordRequests = false + +Ignore = [ + ".databricks", +] diff --git a/acceptance/bundle/resources/model_provider_services/test.toml b/acceptance/bundle/resources/model_provider_services/test.toml new file mode 100644 index 00000000000..90109467fba --- /dev/null +++ b/acceptance/bundle/resources/model_provider_services/test.toml @@ -0,0 +1,7 @@ +# AI Gateway securables are only deployable via the direct deployment engine +# (there is no Terraform provider path for them in bundles). +EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"] + +# Lifecycle tests also run against a real workspace. Tests that inspect the +# recorded request stream (e.g. basic) can't run on cloud and override this. +Cloud = true diff --git a/acceptance/experimental/open/output.txt b/acceptance/experimental/open/output.txt index 436050964c6..f9a43b801be 100644 --- a/acceptance/experimental/open/output.txt +++ b/acceptance/experimental/open/output.txt @@ -9,7 +9,7 @@ === unknown resource type >>> [CLI] experimental open --url unknown 123 -Error: unknown resource type "unknown", must be one of: alerts, apps, catalogs, cluster_policies, clusters, dashboards, database_catalogs, database_instances, experiments, genie_spaces, instance_pools, jobs, mcp_services, model_services, model_serving_endpoints, models, notebooks, pipelines, postgres_catalogs, postgres_synced_tables, quality_monitors, queries, registered_models, schemas, secrets, synced_database_tables, vector_search_endpoints, vector_search_indexes, volumes, warehouses +Error: unknown resource type "unknown", must be one of: alerts, apps, catalogs, cluster_policies, clusters, dashboards, database_catalogs, database_instances, experiments, genie_spaces, instance_pools, jobs, mcp_services, model_provider_services, model_services, model_serving_endpoints, models, notebooks, pipelines, postgres_catalogs, postgres_synced_tables, quality_monitors, queries, registered_models, schemas, secrets, synced_database_tables, vector_search_endpoints, vector_search_indexes, volumes, warehouses === test auto-completion handler >>> [CLI] __complete experimental open , @@ -26,6 +26,7 @@ genie_spaces instance_pools jobs mcp_services +model_provider_services model_services model_serving_endpoints models diff --git a/bundle/config/mutator/resourcemutator/apply_bundle_permissions_test.go b/bundle/config/mutator/resourcemutator/apply_bundle_permissions_test.go index f54d1b5a624..c71bb2c5834 100644 --- a/bundle/config/mutator/resourcemutator/apply_bundle_permissions_test.go +++ b/bundle/config/mutator/resourcemutator/apply_bundle_permissions_test.go @@ -27,6 +27,7 @@ var unsupportedResources = []string{ "registered_models", "model_services", "mcp_services", + "model_provider_services", "database_catalogs", "synced_database_tables", "postgres_branches", diff --git a/bundle/config/mutator/resourcemutator/apply_target_mode_test.go b/bundle/config/mutator/resourcemutator/apply_target_mode_test.go index a0d3132af2b..27d2837ffb1 100644 --- a/bundle/config/mutator/resourcemutator/apply_target_mode_test.go +++ b/bundle/config/mutator/resourcemutator/apply_target_mode_test.go @@ -114,6 +114,9 @@ func mockBundle(mode config.Mode) *bundle.Bundle { McpServices: map[string]*resources.McpService{ "mcpservice1": {McpServiceConfig: resources.McpServiceConfig{Parent: "schemas/main.default", McpServiceId: "mcpservice1"}}, }, + ModelProviderServices: map[string]*resources.ModelProviderService{ + "modelproviderservice1": {ModelProviderServiceConfig: resources.ModelProviderServiceConfig{Parent: "schemas/main.default", ModelProviderServiceId: "modelproviderservice1"}}, + }, RegisteredModels: map[string]*resources.RegisteredModel{ "registeredmodel1": {CreateRegisteredModelRequest: catalog.CreateRegisteredModelRequest{Name: "registeredmodel1"}}, }, diff --git a/bundle/config/mutator/resourcemutator/capture_uc_dependencies.go b/bundle/config/mutator/resourcemutator/capture_uc_dependencies.go index 5d95b8acc2f..330754f0018 100644 --- a/bundle/config/mutator/resourcemutator/capture_uc_dependencies.go +++ b/bundle/config/mutator/resourcemutator/capture_uc_dependencies.go @@ -223,6 +223,12 @@ func (m *captureUCDependencies) Apply(ctx context.Context, b *bundle.Bundle) dia } ms.Parent = resolveParent(b, ms.Parent) } + for _, mps := range b.Config.Resources.ModelProviderServices { + if mps == nil { + continue + } + mps.Parent = resolveParent(b, mps.Parent) + } // Schemas are resolved last because the schema catalog resolution modifies // schema.CatalogName, and findSchema (used by resolveSchema above) matches diff --git a/bundle/config/mutator/resourcemutator/capture_uc_dependencies_test.go b/bundle/config/mutator/resourcemutator/capture_uc_dependencies_test.go index d8c39e3276b..e5281a42a77 100644 --- a/bundle/config/mutator/resourcemutator/capture_uc_dependencies_test.go +++ b/bundle/config/mutator/resourcemutator/capture_uc_dependencies_test.go @@ -147,6 +147,11 @@ func TestCaptureUCDependencies(t *testing.T) { Parent: "schemas/mycatalog.myschema", McpServiceId: "mymcp", }}, }, + ModelProviderServices: map[string]*resources.ModelProviderService{ + "my_mps": {ModelProviderServiceConfig: resources.ModelProviderServiceConfig{ + Parent: "schemas/mycatalog.myschema", ModelProviderServiceId: "mymps", + }}, + }, }, }, } @@ -188,6 +193,9 @@ func TestCaptureUCDependencies(t *testing.T) { // MCP service (same compound parent field). assert.Equal(t, "schemas/"+catalogRef+"."+schemaRef, b.Config.Resources.McpServices["my_mcp_service"].Parent) + + // Model provider service (same compound parent field). + assert.Equal(t, "schemas/"+catalogRef+"."+schemaRef, b.Config.Resources.ModelProviderServices["my_mps"].Parent) } // Pipeline schema and target are mutually exclusive; only the populated field diff --git a/bundle/config/mutator/resourcemutator/run_as_test.go b/bundle/config/mutator/resourcemutator/run_as_test.go index d32f8538060..e5cbbd76878 100644 --- a/bundle/config/mutator/resourcemutator/run_as_test.go +++ b/bundle/config/mutator/resourcemutator/run_as_test.go @@ -49,6 +49,7 @@ func allResourceTypes(t *testing.T) []string { "job_runs", "jobs", "mcp_services", + "model_provider_services", "model_services", "model_serving_endpoints", "models", @@ -191,6 +192,7 @@ var allowList = []string{ "models", "model_services", "mcp_services", + "model_provider_services", "postgres_branches", "postgres_catalogs", "postgres_databases", diff --git a/bundle/config/resources.go b/bundle/config/resources.go index db61c4bdbd1..f13a44617c4 100644 --- a/bundle/config/resources.go +++ b/bundle/config/resources.go @@ -20,6 +20,7 @@ type Resources struct { ModelServingEndpoints map[string]*resources.ModelServingEndpoint `json:"model_serving_endpoints,omitempty"` ModelServices map[string]*resources.ModelService `json:"model_services,omitempty"` McpServices map[string]*resources.McpService `json:"mcp_services,omitempty"` + ModelProviderServices map[string]*resources.ModelProviderService `json:"model_provider_services,omitempty"` RegisteredModels map[string]*resources.RegisteredModel `json:"registered_models,omitempty"` QualityMonitors map[string]*resources.QualityMonitor `json:"quality_monitors,omitempty"` Catalogs map[string]*resources.Catalog `json:"catalogs,omitempty"` @@ -115,6 +116,7 @@ func (r *Resources) AllResources() []ResourceGroup { collectResourceMap(descriptions["model_serving_endpoints"], r.ModelServingEndpoints), collectResourceMap(descriptions["model_services"], r.ModelServices), collectResourceMap(descriptions["mcp_services"], r.McpServices), + collectResourceMap(descriptions["model_provider_services"], r.ModelProviderServices), collectResourceMap(descriptions["registered_models"], r.RegisteredModels), collectResourceMap(descriptions["quality_monitors"], r.QualityMonitors), collectResourceMap(descriptions["catalogs"], r.Catalogs), @@ -189,6 +191,7 @@ func SupportedResources() map[string]resources.ResourceDescription { "model_serving_endpoints": (&resources.ModelServingEndpoint{}).ResourceDescription(), "model_services": (&resources.ModelService{}).ResourceDescription(), "mcp_services": (&resources.McpService{}).ResourceDescription(), + "model_provider_services": (&resources.ModelProviderService{}).ResourceDescription(), "registered_models": (&resources.RegisteredModel{}).ResourceDescription(), "quality_monitors": (&resources.QualityMonitor{}).ResourceDescription(), "catalogs": (&resources.Catalog{}).ResourceDescription(), diff --git a/bundle/config/resources/model_provider_service.go b/bundle/config/resources/model_provider_service.go new file mode 100644 index 00000000000..3339f2ae9a8 --- /dev/null +++ b/bundle/config/resources/model_provider_service.go @@ -0,0 +1,104 @@ +package resources + +import ( + "context" + "net/url" + + "github.com/databricks/cli/libs/log" + "github.com/databricks/cli/libs/workspaceurls" + "github.com/databricks/databricks-sdk-go" + "github.com/databricks/databricks-sdk-go/apierr" + "github.com/databricks/databricks-sdk-go/marshal" + "github.com/databricks/databricks-sdk-go/service/catalog" +) + +// ModelProviderServiceConfig is the bundle-authored state for an AI Gateway +// model provider service. +// +// It mirrors ModelServiceConfig: the SDK models the create inputs `parent` and +// `model_provider_service_id` as URL parameters (`json:"-"`) outside the +// ModelProviderService body and derives the resource `name` +// (`model-provider-services/{catalog}.{schema}.{model_provider_service}`) +// server-side, so we expose a flat struct with the immutable identity plus the +// mutable body. Owner is not exposed yet (the API returns effective_owner on +// read, not owner). +// +// Note: config.provider_type is immutable after create (the API rejects +// changing it via Update); it is classified recreate_on_changes in +// resources.yml. +type ModelProviderServiceConfig struct { + // Parent schema, format `schemas/{catalog}.{schema}`. Immutable: the server + // derives `name` from parent + model_provider_service_id, so changing it + // recreates the resource. + Parent string `json:"parent"` + // Leaf id of the model provider service, e.g. "openai_prod". Immutable. + ModelProviderServiceId string `json:"model_provider_service_id"` + // User-provided description. + Comment string `json:"comment,omitempty"` + // Behavioral configuration: provider connection, model catalog, passthrough + // policy. config.provider_type is required at create and immutable after. + Config *catalog.ModelProviderServiceConfig `json:"config,omitempty"` + + ForceSendFields []string `json:"-" url:"-"` +} + +func (c *ModelProviderServiceConfig) UnmarshalJSON(b []byte) error { + return marshal.Unmarshal(b, c) +} + +func (c ModelProviderServiceConfig) MarshalJSON() ([]byte, error) { + return marshal.Marshal(c) +} + +type ModelProviderService struct { + BaseResource + ModelProviderServiceConfig +} + +// UnmarshalJSON / MarshalJSON are defined on the wrapper so it does not inherit +// ModelProviderServiceConfig's promoted marshaler, which would silently drop the +// BaseResource fields (id, url, lifecycle, modified_status). +func (m *ModelProviderService) UnmarshalJSON(b []byte) error { + return marshal.Unmarshal(b, m) +} + +func (m ModelProviderService) MarshalJSON() ([]byte, error) { + return marshal.Marshal(m) +} + +func (m *ModelProviderService) Exists(ctx context.Context, w *databricks.WorkspaceClient, id string) (bool, error) { + // The engine tracks the id as the bare + // {catalog}.{schema}.{model_provider_service}; the API addresses the + // resource by its full name. + _, err := w.AiGateway.GetModelProviderService(ctx, catalog.GetModelProviderServiceRequest{Name: "model-provider-services/" + id}) + if err != nil { + log.Debugf(ctx, "model provider service %s does not exist", id) + if apierr.IsMissing(err) { + return false, nil + } + return false, err + } + return true, nil +} + +func (*ModelProviderService) ResourceDescription() ResourceDescription { + return ResourceDescription{ + SingularName: "model_provider_service", + PluralName: "model_provider_services", + SingularTitle: "Model provider service", + PluralTitle: "Model provider services", + } +} + +func (m *ModelProviderService) InitializeURL(baseURL url.URL) { + if m.ID == "" { + return + } + // The id is the bare {catalog}.{schema}.{model_provider_service}; ResourceURL + // splits it into the Catalog Explorer path explore/data/model-provider-services/... + m.URL = workspaceurls.ResourceURL(baseURL, "model_provider_services", m.ID) +} + +func (m *ModelProviderService) GetName() string { + return m.ModelProviderServiceId +} diff --git a/bundle/config/resources_test.go b/bundle/config/resources_test.go index fb89d49c3c5..c666c8964c0 100644 --- a/bundle/config/resources_test.go +++ b/bundle/config/resources_test.go @@ -253,6 +253,11 @@ func TestResourcesBindSupport(t *testing.T) { McpServiceConfig: resources.McpServiceConfig{}, }, }, + ModelProviderServices: map[string]*resources.ModelProviderService{ + "my_model_provider_service": { + ModelProviderServiceConfig: resources.ModelProviderServiceConfig{}, + }, + }, SecretScopes: map[string]*resources.SecretScope{ "my_secret_scope": { Name: "0", @@ -402,6 +407,7 @@ func TestResourcesBindSupport(t *testing.T) { m.GetMockServingEndpointsAPI().EXPECT().Get(mock.Anything, mock.Anything).Return(nil, nil) m.GetMockAiGatewayAPI().EXPECT().GetModelService(mock.Anything, mock.Anything).Return(nil, nil) m.GetMockAiGatewayAPI().EXPECT().GetMcpService(mock.Anything, mock.Anything).Return(nil, nil) + m.GetMockAiGatewayAPI().EXPECT().GetModelProviderService(mock.Anything, mock.Anything).Return(nil, nil) m.GetMockSecretsAPI().EXPECT().ListScopesAll(mock.Anything).Return([]workspace.SecretScope{ {Name: "0"}, }, nil) diff --git a/bundle/deploy/terraform/lifecycle_test.go b/bundle/deploy/terraform/lifecycle_test.go index dc592750113..508d9610f87 100644 --- a/bundle/deploy/terraform/lifecycle_test.go +++ b/bundle/deploy/terraform/lifecycle_test.go @@ -28,6 +28,7 @@ func TestConvertLifecycleForAllResources(t *testing.T) { // AI Gateway model service is deployed through the direct engine only. "model_services", "mcp_services", + "model_provider_services", "secrets", "vector_search_endpoints", "vector_search_indexes", diff --git a/bundle/direct/dresources/all.go b/bundle/direct/dresources/all.go index 615a704c6ca..942f7f1f648 100644 --- a/bundle/direct/dresources/all.go +++ b/bundle/direct/dresources/all.go @@ -38,6 +38,7 @@ var SupportedResources = map[string]any{ "model_serving_endpoints": (*ResourceModelServingEndpoint)(nil), "model_services": (*ResourceModelService)(nil), "mcp_services": (*ResourceMcpService)(nil), + "model_provider_services": (*ResourceModelProviderService)(nil), "quality_monitors": (*ResourceQualityMonitor)(nil), "vector_search_endpoints": (*ResourceVectorSearchEndpoint)(nil), "vector_search_indexes": (*ResourceVectorSearchIndex)(nil), diff --git a/bundle/direct/dresources/all_test.go b/bundle/direct/dresources/all_test.go index 92229daad93..de607f04fa5 100644 --- a/bundle/direct/dresources/all_test.go +++ b/bundle/direct/dresources/all_test.go @@ -114,6 +114,14 @@ var testConfig map[string]any = map[string]any{ }, }, + "model_provider_services": &resources.ModelProviderService{ + ModelProviderServiceConfig: resources.ModelProviderServiceConfig{ + Parent: "schemas/main.default", + ModelProviderServiceId: "my_model_provider_service", + Comment: "Test model provider service", + }, + }, + "registered_models": &resources.RegisteredModel{ CreateRegisteredModelRequest: catalog.CreateRegisteredModelRequest{ Name: "my_registered_model", diff --git a/bundle/direct/dresources/apitypes.generated.yml b/bundle/direct/dresources/apitypes.generated.yml index 4d5aa8f4b7a..af96326fa4c 100644 --- a/bundle/direct/dresources/apitypes.generated.yml +++ b/bundle/direct/dresources/apitypes.generated.yml @@ -30,6 +30,8 @@ jobs: jobs.JobSettings mcp_services: catalog.CreateMcpServiceRequest +model_provider_services: catalog.CreateModelProviderServiceRequest + model_services: catalog.CreateModelServiceRequest model_serving_endpoints: serving.CreateServingEndpoint diff --git a/bundle/direct/dresources/model_provider_service.go b/bundle/direct/dresources/model_provider_service.go new file mode 100644 index 00000000000..959dff9baca --- /dev/null +++ b/bundle/direct/dresources/model_provider_service.go @@ -0,0 +1,139 @@ +package dresources + +import ( + "context" + "fmt" + "strings" + + "github.com/databricks/cli/bundle/config/resources" + "github.com/databricks/databricks-sdk-go" + "github.com/databricks/databricks-sdk-go/common/types/fieldmask" + "github.com/databricks/databricks-sdk-go/service/catalog" +) + +// AI Gateway model provider service. +// API: https://docs.databricks.com/api/workspace/aigateway +// Terraform: databricks_ai_gateway_model_provider_service +// +// Mirrors ResourceModelService: the remote type returned by DoRead is the same +// bundle-local resources.ModelProviderServiceConfig used for state (so +// RemapState is not needed), and DoRead reconstructs the create-time identity +// (parent + model_provider_service_id) from the server-derived resource name. +const modelProviderServiceNamePrefix = "model-provider-services/" + +type ResourceModelProviderService struct { + client *databricks.WorkspaceClient +} + +func (*ResourceModelProviderService) New(client *databricks.WorkspaceClient) *ResourceModelProviderService { + return &ResourceModelProviderService{client: client} +} + +func (*ResourceModelProviderService) PrepareState(input *resources.ModelProviderService) *resources.ModelProviderServiceConfig { + return &input.ModelProviderServiceConfig +} + +// modelProviderServiceIdentityFromName reconstructs the create-time parent and +// leaf id from the server-derived resource name +// `model-provider-services/{catalog}.{schema}.{model_provider_service}`. +func modelProviderServiceIdentityFromName(name string) (parent, modelProviderServiceId string, err error) { + rest, ok := strings.CutPrefix(name, modelProviderServiceNamePrefix) + if !ok { + return "", "", fmt.Errorf("unexpected model provider service name %q (want model-provider-services/{catalog}.{schema}.{model_provider_service})", name) + } + parts := strings.Split(rest, ".") + if len(parts) != 3 { + return "", "", fmt.Errorf("unexpected model provider service name %q (want three dot-separated components)", name) + } + return "schemas/" + parts[0] + "." + parts[1], parts[2], nil +} + +func responseToModelProviderServiceConfig(ms *catalog.ModelProviderService) (*resources.ModelProviderServiceConfig, error) { + parent, id, err := modelProviderServiceIdentityFromName(ms.Name) + if err != nil { + return nil, err + } + return &resources.ModelProviderServiceConfig{ + Parent: parent, + ModelProviderServiceId: id, + Comment: ms.Comment, + Config: ms.Config, + ForceSendFields: nil, + }, nil +} + +// modelProviderServiceBody builds the ModelProviderService write payload from the +// bundle config. Only comment and config are client-settable; every other field +// is OUTPUT_ONLY (server-derived) and sent as its zero value. +func modelProviderServiceBody(config *resources.ModelProviderServiceConfig) catalog.ModelProviderService { + return catalog.ModelProviderService{ + Comment: config.Comment, + Config: config.Config, + CreateTime: nil, + CreatedBy: "", + EffectiveOwner: "", + Etag: "", + MetastoreId: "", + Name: "", + Owner: "", + UpdateTime: nil, + UpdatedBy: "", + ForceSendFields: nil, + } +} + +func (r *ResourceModelProviderService) DoRead(ctx context.Context, id string) (*resources.ModelProviderServiceConfig, error) { + ms, err := r.client.AiGateway.GetModelProviderService(ctx, catalog.GetModelProviderServiceRequest{Name: modelProviderServiceNamePrefix + id}) + if err != nil { + return nil, err + } + return responseToModelProviderServiceConfig(ms) +} + +func (r *ResourceModelProviderService) DoCreate(ctx context.Context, config *resources.ModelProviderServiceConfig) (string, *resources.ModelProviderServiceConfig, error) { + resp, err := r.client.AiGateway.CreateModelProviderService(ctx, catalog.CreateModelProviderServiceRequest{ + Parent: config.Parent, + ModelProviderServiceId: config.ModelProviderServiceId, + ModelProviderService: modelProviderServiceBody(config), + }) + if err != nil { + return "", nil, err + } + state, err := responseToModelProviderServiceConfig(resp) + if err != nil { + return "", nil, err + } + return strings.TrimPrefix(resp.Name, modelProviderServiceNamePrefix), state, nil +} + +// DoUpdate sends update_mask "*" on every update. name, parent and +// model_provider_service_id are immutable (provided_id_fields), and +// config.provider_type is immutable (recreate_on_changes), so the wildcard +// replaces every client-settable field (comment + a full config replace), +// matching the mask the Terraform provider generates. +// +// Etag is intentionally left empty here and in DoDelete: an empty etag means no +// If-Match precondition (last-write-wins), matching the Terraform provider, +// which also does not send etag. We deliberately do not do optimistic +// concurrency on these resources. +func (r *ResourceModelProviderService) DoUpdate(ctx context.Context, id string, config *resources.ModelProviderServiceConfig, _ *PlanEntry) (*resources.ModelProviderServiceConfig, error) { + resp, err := r.client.AiGateway.UpdateModelProviderService(ctx, catalog.UpdateModelProviderServiceRequest{ + Etag: "", + Name: modelProviderServiceNamePrefix + id, + ModelProviderService: modelProviderServiceBody(config), + UpdateMask: fieldmask.FieldMask{Paths: []string{"*"}}, + ForceSendFields: nil, + }) + if err != nil { + return nil, err + } + return responseToModelProviderServiceConfig(resp) +} + +func (r *ResourceModelProviderService) DoDelete(ctx context.Context, id string, _ *resources.ModelProviderServiceConfig) error { + return r.client.AiGateway.DeleteModelProviderService(ctx, catalog.DeleteModelProviderServiceRequest{ + Etag: "", + Name: modelProviderServiceNamePrefix + id, + ForceSendFields: nil, + }) +} diff --git a/bundle/internal/schema/annotations.yml b/bundle/internal/schema/annotations.yml index 80fb71509fa..07cbbe6467e 100644 --- a/bundle/internal/schema/annotations.yml +++ b/bundle/internal/schema/annotations.yml @@ -1213,6 +1213,25 @@ resources: "parent": "description": |- PLACEHOLDER + "model_provider_services": + "description": |- + PLACEHOLDER + "$fields": + "comment": + "description": |- + PLACEHOLDER + "config": + "description": |- + PLACEHOLDER + "lifecycle": + "description": |- + PLACEHOLDER + "model_provider_service_id": + "description": |- + PLACEHOLDER + "parent": + "description": |- + PLACEHOLDER "model_services": "description": |- PLACEHOLDER diff --git a/bundle/internal/validation/generated/enum_fields.go b/bundle/internal/validation/generated/enum_fields.go index 5b1d69131f2..7330663133f 100644 --- a/bundle/internal/validation/generated/enum_fields.go +++ b/bundle/internal/validation/generated/enum_fields.go @@ -39,7 +39,7 @@ var EnumFields = map[string][]string{ "resources.apps.*.resources[*].uc_securable.permission": {"EXECUTE", "MODIFY", "READ_VOLUME", "SELECT", "USE_CONNECTION", "WRITE_VOLUME"}, "resources.apps.*.resources[*].uc_securable.securable_type": {"CONNECTION", "FUNCTION", "TABLE", "VOLUME"}, - "resources.catalogs.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.catalogs.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, "resources.cluster_policies.*.permissions[*].level": {"CAN_USE"}, @@ -63,7 +63,7 @@ var EnumFields = map[string][]string{ "resources.experiments.*.permissions[*].level": {"CAN_EDIT", "CAN_MANAGE", "CAN_READ"}, "resources.external_locations.*.encryption_details.sse_encryption_details.algorithm": {"AWS_SSE_KMS", "AWS_SSE_S3"}, - "resources.external_locations.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.external_locations.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, "resources.genie_spaces.*.permissions[*].level": {"CAN_ATTACH_TO", "CAN_BIND", "CAN_CREATE", "CAN_CREATE_APP", "CAN_EDIT", "CAN_EDIT_METADATA", "CAN_MANAGE", "CAN_MANAGE_PRODUCTION_VERSIONS", "CAN_MANAGE_RUN", "CAN_MANAGE_STAGING_VERSIONS", "CAN_MONITOR", "CAN_MONITOR_ONLY", "CAN_QUERY", "CAN_READ", "CAN_RESTART", "CAN_RUN", "CAN_USE", "CAN_VIEW", "CAN_VIEW_METADATA", "IS_OWNER"}, @@ -100,11 +100,11 @@ var EnumFields = map[string][]string{ "resources.jobs.*.schedule.pause_status": {"PAUSED", "UNPAUSED"}, "resources.jobs.*.schedule.sql_condition.trigger_mode": {"QUERY_RETURNS_ROWS", "RESULT_VALUE_CHANGES"}, "resources.jobs.*.tasks[*].ai_runtime_task.deployments[*].compute.accelerator_type": {"GPU_1xA10", "GPU_1xH100", "GPU_8xH100"}, - "resources.jobs.*.tasks[*].compute.hardware_accelerator": {"GPU_1xA10", "GPU_1xH100", "GPU_8xB300", "GPU_8xH100"}, + "resources.jobs.*.tasks[*].compute.hardware_accelerator": {"GPU_1xA10", "GPU_1xH100", "GPU_8xH100"}, "resources.jobs.*.tasks[*].condition_task.op": {"EQUAL_TO", "GREATER_THAN", "GREATER_THAN_OR_EQUAL", "LESS_THAN", "LESS_THAN_OR_EQUAL", "NOT_EQUAL"}, "resources.jobs.*.tasks[*].dbt_task.source": {"GIT", "WORKSPACE"}, "resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments[*].compute.accelerator_type": {"GPU_1xA10", "GPU_1xH100", "GPU_8xH100"}, - "resources.jobs.*.tasks[*].for_each_task.task.compute.hardware_accelerator": {"GPU_1xA10", "GPU_1xH100", "GPU_8xB300", "GPU_8xH100"}, + "resources.jobs.*.tasks[*].for_each_task.task.compute.hardware_accelerator": {"GPU_1xA10", "GPU_1xH100", "GPU_8xH100"}, "resources.jobs.*.tasks[*].for_each_task.task.condition_task.op": {"EQUAL_TO", "GREATER_THAN", "GREATER_THAN_OR_EQUAL", "LESS_THAN", "LESS_THAN_OR_EQUAL", "NOT_EQUAL"}, "resources.jobs.*.tasks[*].for_each_task.task.dbt_task.source": {"GIT", "WORKSPACE"}, "resources.jobs.*.tasks[*].for_each_task.task.gen_ai_compute_task.source": {"GIT", "WORKSPACE"}, @@ -158,10 +158,15 @@ var EnumFields = map[string][]string{ "resources.jobs.*.triggers[*].sql_condition.trigger_mode": {"QUERY_RETURNS_ROWS", "RESULT_VALUE_CHANGES"}, "resources.jobs.*.triggers[*].table_update.condition": {"ALL_UPDATED", "ANY_UPDATED"}, - "resources.mcp_services.*.config.rate_limits[*].key": {"RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"}, + "resources.mcp_services.*.config.rate_limits[*].key": {"RATE_LIMIT_KEY_REQUEST_TAG", "RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"}, "resources.mcp_services.*.config.rate_limits[*].renewal_period": {"RATE_LIMIT_RENEWAL_PERIOD_HOUR", "RATE_LIMIT_RENEWAL_PERIOD_MINUTE"}, - "resources.model_services.*.config.rate_limits[*].key": {"RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"}, + "resources.model_provider_services.*.config.anthropic.relayed.plan_type": {"ANTHROPIC_RELAYED_PLAN_TYPE_MAX", "ANTHROPIC_RELAYED_PLAN_TYPE_TEAM_ENTERPRISE"}, + "resources.model_provider_services.*.config.provider_type": {"EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK", "EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC", "EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI", "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM", "EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE", "EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY", "EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI"}, + "resources.model_provider_services.*.config.rate_limits[*].key": {"RATE_LIMIT_KEY_REQUEST_TAG", "RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"}, + "resources.model_provider_services.*.config.rate_limits[*].renewal_period": {"RATE_LIMIT_RENEWAL_PERIOD_HOUR", "RATE_LIMIT_RENEWAL_PERIOD_MINUTE"}, + + "resources.model_services.*.config.rate_limits[*].key": {"RATE_LIMIT_KEY_REQUEST_TAG", "RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"}, "resources.model_services.*.config.rate_limits[*].renewal_period": {"RATE_LIMIT_RENEWAL_PERIOD_HOUR", "RATE_LIMIT_RENEWAL_PERIOD_MINUTE"}, "resources.model_services.*.config.routing.destinations[*].destination_type": {"DESTINATION_TYPE_EXTERNAL_FOUNDATION_MODEL", "DESTINATION_TYPE_PAY_PER_TOKEN_FOUNDATION_MODEL", "DESTINATION_TYPE_PROVISIONED_THROUGHPUT_FOUNDATION_MODEL"}, "resources.model_services.*.config.routing.fallback.destinations[*].destination_type": {"DESTINATION_TYPE_EXTERNAL_FOUNDATION_MODEL", "DESTINATION_TYPE_PAY_PER_TOKEN_FOUNDATION_MODEL", "DESTINATION_TYPE_PROVISIONED_THROUGHPUT_FOUNDATION_MODEL"}, @@ -257,14 +262,14 @@ var EnumFields = map[string][]string{ "resources.quality_monitors.*.inference_log.problem_type": {"PROBLEM_TYPE_CLASSIFICATION", "PROBLEM_TYPE_REGRESSION"}, "resources.quality_monitors.*.schedule.pause_status": {"PAUSED", "UNPAUSED", "UNSPECIFIED"}, - "resources.registered_models.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.registered_models.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, - "resources.schemas.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.schemas.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, "resources.secret_scopes.*.backend_type": {"AZURE_KEYVAULT", "DATABRICKS"}, "resources.secret_scopes.*.permissions[*].level": {"READ", "WRITE", "MANAGE"}, - "resources.secrets.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.secrets.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, "resources.sql_warehouses.*.channel.name": {"CHANNEL_NAME_CURRENT", "CHANNEL_NAME_CUSTOM", "CHANNEL_NAME_PREVIEW", "CHANNEL_NAME_PREVIOUS"}, "resources.sql_warehouses.*.permissions[*].level": {"CAN_MANAGE", "CAN_MONITOR", "CAN_USE", "CAN_VIEW", "IS_OWNER"}, @@ -283,11 +288,11 @@ var EnumFields = map[string][]string{ "resources.vector_search_endpoints.*.permissions[*].level": {"CAN_CREATE", "CAN_MANAGE", "CAN_USE"}, "resources.vector_search_indexes.*.delta_sync_index_spec.pipeline_type": {"CONTINUOUS", "TRIGGERED"}, - "resources.vector_search_indexes.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.vector_search_indexes.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, "resources.vector_search_indexes.*.index_subtype": {"FULL_TEXT", "HYBRID", "VECTOR"}, "resources.vector_search_indexes.*.index_type": {"DELTA_SYNC", "DIRECT_ACCESS"}, - "resources.volumes.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.volumes.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, "resources.volumes.*.volume_type": {"EXTERNAL", "MANAGED"}, "variables.*.type": {"complex"}, diff --git a/bundle/internal/validation/generated/required_fields.go b/bundle/internal/validation/generated/required_fields.go index a0ce0e286d3..5617f9f5ffa 100644 --- a/bundle/internal/validation/generated/required_fields.go +++ b/bundle/internal/validation/generated/required_fields.go @@ -207,6 +207,14 @@ var RequiredFields = map[string][]string{ "resources.mcp_services.*.config.rate_limits[*]": {"key", "renewal_period"}, "resources.mcp_services.*.config.source_connection": {"name"}, + "resources.model_provider_services.*": {"parent", "model_provider_service_id"}, + "resources.model_provider_services.*.config.amazon_bedrock.direct.service_credential": {"name"}, + "resources.model_provider_services.*.config.azure_openai.direct.service_credential": {"name"}, + "resources.model_provider_services.*.config.inference_table": {"parent"}, + "resources.model_provider_services.*.config.microsoft_foundry.direct.service_credential": {"name"}, + "resources.model_provider_services.*.config.rate_limits[*]": {"key", "renewal_period"}, + "resources.model_provider_services.*.config.targets[*]": {"model"}, + "resources.model_services.*": {"parent", "model_service_id"}, "resources.model_services.*.config.inference_table": {"parent"}, "resources.model_services.*.config.rate_limits[*]": {"key", "renewal_period"}, diff --git a/bundle/schema/jsonschema.json b/bundle/schema/jsonschema.json index 195b2972b16..cbee78b1fea 100644 --- a/bundle/schema/jsonschema.json +++ b/bundle/schema/jsonschema.json @@ -1778,6 +1778,39 @@ } ] }, + "resources.ModelProviderService": { + "oneOf": [ + { + "type": "object", + "properties": { + "comment": { + "$ref": "#/$defs/string" + }, + "config": { + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfig" + }, + "lifecycle": { + "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle" + }, + "model_provider_service_id": { + "$ref": "#/$defs/string" + }, + "parent": { + "$ref": "#/$defs/string" + } + }, + "additionalProperties": false, + "required": [ + "parent", + "model_provider_service_id" + ] + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, "resources.ModelService": { "oneOf": [ { @@ -3995,6 +4028,9 @@ "mcp_services": { "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.McpService" }, + "model_provider_services": { + "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.ModelProviderService" + }, "model_services": { "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.ModelService" }, @@ -5492,6 +5528,521 @@ } ] }, + "catalog.ModelProviderServiceConfig": { + "oneOf": [ + { + "type": "object", + "description": "Behavioral configuration for a ModelProviderService: provider connection\n(auth + provider-specific fields), the catalog of models this provider\nservice can route to, and the passthrough policy that governs how request\nheaders, query parameters, and unmanaged subpaths cross the trust boundary\nto the upstream provider.", + "properties": { + "allow_all_targets": { + "description": "[Beta] When true, accepts any model exposed by the upstream provider; `targets`\nis not required and does not restrict routability. When false, only\nmodels listed in `targets` are routable.", + "$ref": "#/$defs/bool", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "amazon_bedrock": { + "description": "[Beta] Amazon Bedrock provider configuration.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAmazonBedrockProviderConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "anthropic": { + "description": "[Beta] Anthropic provider configuration. Exactly one of `direct` or `relayed` must\nbe set on Create; the two are mutually exclusive.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAnthropicProviderConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "azure_openai": { + "description": "[Beta] Azure OpenAI provider configuration.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAzureOpenAiProviderConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "custom": { + "description": "[Beta] Custom provider configuration: arbitrary HTTP endpoint with bearer-token auth.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigCustomProviderConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "forward_headers": { + "description": "[Beta] Whether to forward incoming request headers to the upstream provider.\nApplies to managed (multi-model) requests as well as passthrough requests\nserved by this provider service. Governance-level decision by the provider\nservice owner; not selectable per inference call.", + "$ref": "#/$defs/bool", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "forward_query_parameters": { + "description": "[Beta] Whether to forward incoming request query parameters to the upstream\nprovider. Same trust-boundary semantics as `forward_headers`.", + "$ref": "#/$defs/bool", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "forward_unmanaged_paths": { + "description": "[Beta] Whether to forward request paths that fall outside this service's managed\nAPI set to the upstream provider as opaque passthrough. When true,\nrequests addressed to subpaths not recognized by the managed API surface\nare proxied to the upstream provider over the same provider connection.\nWhen false, only managed-API paths are served. Governance-level decision\nby the provider service owner; expanding this expands the trust boundary\nthat the ModelProviderService exposes.", + "$ref": "#/$defs/bool", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "gemini_enterprise": { + "description": "[Beta] Gemini Enterprise provider configuration.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigGeminiEnterpriseProviderConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "inference_table": { + "description": "[Beta] Inference table configuration for payload logging when this provider\nservice is invoked directly. When it is invoked through a model service,\nthe model service's own inference table captures the invocation instead.\nMirrors `ModelServiceConfig.inference_table` /\n`AgentServiceConfig.inference_table`.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.InferenceTableConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "microsoft_foundry": { + "description": "[Beta] Microsoft Foundry provider configuration.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigMicrosoftFoundryProviderConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "openai": { + "description": "[Beta] OpenAI provider configuration.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigOpenAiProviderConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "provider_type": { + "description": "[Beta] Provider type discriminator. Required at create time; immutable after.\nDetermines which variant of the `provider` oneof must be set. May not be\nchanged via Update; attempts to include `config.provider_type` in\n`UpdateModelProviderServiceRequest.update_mask` are rejected.\n\nRequired on CreateModelProviderService and immutable thereafter.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigExternalModelProviderType", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "rate_limits": { + "description": "[Beta] Rate limits applied when this provider service is invoked directly. When\nit is invoked through a model service, the model service's own\n`rate_limits` apply instead. Mirrors `ModelServiceConfig.rate_limits` /\n`McpServiceConfig.rate_limits`.", + "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.RateLimit", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "targets": { + "description": "[Beta] Routing targets this provider service exposes (provider-side model\nidentifier + unified API types per entry). Required (\u003e=1) when\n`allow_all_targets = false`; optional and additive when\n`allow_all_targets = true`. References from `ExternalModelConfig.target`\nmust match an entry here unless `allow_all_targets = true`.", + "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigModelTargetConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigAmazonBedrockProviderConfig": { + "oneOf": [ + { + "type": "object", + "description": "Amazon Bedrock provider configuration.", + "properties": { + "direct": { + "description": "[Beta] Direct form of Amazon Bedrock provider config.\n\nAuthentication is one of two mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- Access keys: set `aws_access_key`, leave `service_credential` unset.\n- UC service credential: set `service_credential.name` to the AIP-122\nresource-name form `credentials/{name}`, leave `aws_access_key` unset. The\ncredential value lives in UC and is referenced by name, not held on this\nmessage.\nSetting more than one mode is rejected.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAmazonBedrockProviderDirectConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigAmazonBedrockProviderDirectConfig": { + "oneOf": [ + { + "type": "object", + "description": "Direct form of Amazon Bedrock provider config.\n\nAuthentication is one of two mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- Access keys: set `aws_access_key`, leave `service_credential` unset.\n- UC service credential: set `service_credential.name` to the AIP-122\nresource-name form `credentials/{name}`, leave `aws_access_key` unset. The\ncredential value lives in UC and is referenced by name, not held on this\nmessage.\nSetting more than one mode is rejected.", + "properties": { + "aws_access_key": { + "description": "[Beta] AWS access-key-pair auth. Mutually exclusive with `service_credential`.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAwsAccessKey", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "region": { + "description": "[Beta] AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`).\nRequired on Create.", + "$ref": "#/$defs/string", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "service_credential": { + "description": "[Beta] Reference to a UC service credential authorizing Bedrock requests. On\nCreate the caller supplies `service_credential.name` in the AIP-122\nresource-name form `credentials/{name}`. Required on Create when using\nUC-service-credential auth; mutually exclusive with `aws_access_key`. The\ncredential is referenced by name; its value is not carried here. On read the\nresolved `id` and `is_deleted` are also populated. Only supported on AWS-hosted\nworkspaces; Create requests from other clouds are rejected with\nINVALID_PARAMETER_VALUE.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigServiceCredential", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigAnthropicProviderConfig": { + "oneOf": [ + { + "type": "object", + "description": "Anthropic provider configuration. Exactly one of `direct` or `relayed` must\nbe set on Create; the two are mutually exclusive.", + "properties": { + "direct": { + "description": "[Beta] Direct (inline-credentials) form: caller supplies the API key in the\nrequest body. Required on Create unless `relayed` is set.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAnthropicProviderDirectConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "relayed": { + "description": "[Beta] Relayed (credential-less) form: no Anthropic credential is stored. Each\ninference request instead carries the caller's own OAuth token, which the\nplatform forwards to Anthropic on outbound requests. Mutually exclusive\nwith `direct`; no `api_key` is required or persisted.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigAnthropicProviderDirectConfig": { + "oneOf": [ + { + "type": "object", + "description": "Direct form of Anthropic provider config.", + "properties": { + "api_key": { + "description": "[Beta] Anthropic API key. Required on Create. Sent as the `x-api-key` header on\noutbound requests. Supplied as inline plaintext via\n`ProviderSecret.plaintext`.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfig": { + "oneOf": [ + { + "type": "object", + "description": "Relayed form of Anthropic provider config: no credential is stored.\nAuthentication is the caller's own OAuth token, forwarded to Anthropic on\noutbound requests, so there is no persisted secret. Presence of this variant\nis the signal that the provider service uses relayed auth; `plan_type`\nfurther distinguishes which Anthropic subscription tier the token belongs to.", + "properties": { + "plan_type": { + "description": "[Beta] Which Anthropic subscription tier the relayed token belongs to. Optional;\nwhen unset the MPS gets the full governance surface (see TEAM_ENTERPRISE).\nImmutable after Create, so the tier cannot be flipped in place.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType": { + "oneOf": [ + { + "type": "string", + "description": "Which Anthropic subscription tier the relayed OAuth token belongs to.\nImmutable after Create (switching tiers changes which governance controls\nthe platform enforces). Only MAX and TEAM_ENTERPRISE differ in the\ngovernance surface the gateway can enforce, not in how the token is\nrelayed.", + "enum": [ + "ANTHROPIC_RELAYED_PLAN_TYPE_MAX", + "ANTHROPIC_RELAYED_PLAN_TYPE_TEAM_ENTERPRISE" + ], + "enumDescriptions": [ + "[Beta]", + "[Beta]" + ] + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigAwsAccessKey": { + "oneOf": [ + { + "type": "object", + "description": "AWS access-key-pair auth for Amazon Bedrock: a SigV4-signing key pair.", + "properties": { + "access_key_id": { + "description": "[Beta] AWS access key ID. Required on Create when using access-key auth. Treated as\nusername-equivalent (not a secret value): round-trips on reads and is\nscrubbed from audit logs.", + "$ref": "#/$defs/string", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "secret_access_key": { + "description": "[Beta] AWS secret access key paired with `access_key_id`. Required on Create when\nusing access-key auth. Supplied as inline plaintext via\n`ProviderSecret.plaintext`.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigAzureOpenAiProviderConfig": { + "oneOf": [ + { + "type": "object", + "description": "Azure OpenAI provider configuration.", + "properties": { + "direct": { + "description": "[Beta] Direct form of Azure OpenAI provider config. Exactly one of three\nmutually-exclusive auth modes must be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset.\n- UC service credential: set `service_credential.name` to the AIP-122\nresource-name form `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in UC and is\nreferenced by name, not held on this message. Only supported on\nAzure-hosted workspaces.\nSetting more than one mode is rejected.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAzureOpenAiProviderDirectConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigAzureOpenAiProviderDirectConfig": { + "oneOf": [ + { + "type": "object", + "description": "Direct form of Azure OpenAI provider config. Exactly one of three\nmutually-exclusive auth modes must be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset.\n- UC service credential: set `service_credential.name` to the AIP-122\nresource-name form `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in UC and is\nreferenced by name, not held on this message. Only supported on\nAzure-hosted workspaces.\nSetting more than one mode is rejected.", + "properties": { + "api_key": { + "description": "[Beta] Azure OpenAI API key. Mutually exclusive with the Entra and\nservice-credential modes. Supplied as inline plaintext via\n`ProviderSecret.plaintext`.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "base_url": { + "description": "[Beta] Full Azure OpenAI endpoint base URL, e.g.\n`https://myresource.openai.azure.com`. Required on Create.", + "$ref": "#/$defs/string", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "entra_service_principal": { + "description": "[Beta] Entra ID (service principal) auth. Mutually exclusive with `api_key` and\n`service_credential`.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigEntraServicePrincipal", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "service_credential": { + "description": "[Beta] Reference to a UC service credential authorizing Azure OpenAI requests. On\nCreate the caller supplies `service_credential.name` in the AIP-122\nresource-name form `credentials/{name}`. Required on Create when using\nUC-service-credential auth; mutually exclusive with `api_key` and\n`entra_service_principal`. The credential is\nreferenced by name; its value is not carried here. On read the resolved `id`\nand `is_deleted` are also populated. Only supported on Azure-hosted\nworkspaces; Create requests from other clouds are rejected with\nINVALID_PARAMETER_VALUE.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigServiceCredential", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigCustomProviderConfig": { + "oneOf": [ + { + "type": "object", + "description": "Custom provider configuration: arbitrary HTTP endpoint with bearer-token auth.", + "properties": { + "direct": { + "description": "[Beta] Direct form of custom provider config.\n\nAuthentication is one of two mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- Bearer: set `api_key`, leave `header_auth` unset. The secret is\nforwarded as `Authorization: Bearer \u003csecret\u003e`.\n- Header: set `header_auth`, leave `api_key` unset. The secret is\nforwarded as `\u003capi_key_name\u003e: \u003capi_key_value\u003e`.\nSetting both modes or neither mode is rejected.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigCustomProviderDirectConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigCustomProviderDirectConfig": { + "oneOf": [ + { + "type": "object", + "description": "Direct form of custom provider config.\n\nAuthentication is one of two mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- Bearer: set `api_key`, leave `header_auth` unset. The secret is\nforwarded as `Authorization: Bearer \u003csecret\u003e`.\n- Header: set `header_auth`, leave `api_key` unset. The secret is\nforwarded as `\u003capi_key_name\u003e: \u003capi_key_value\u003e`.\nSetting both modes or neither mode is rejected.", + "properties": { + "api_key": { + "description": "[Beta] Bearer token forwarded as the `Authorization: Bearer ...` header on\noutbound requests. Supplied as inline plaintext via\n`ProviderSecret.plaintext`. Set this for bearer-token auth.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "base_url": { + "description": "[Beta] Endpoint URL of the OpenAI-compatible service (e.g.,\n`https://api.example.com/v1`). Required on Create.", + "$ref": "#/$defs/string", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigEntraServicePrincipal": { + "oneOf": [ + { + "type": "object", + "description": "Entra ID (Azure AD) service-principal auth: AI Gateway exchanges the\n`tenant_id` + `client_id` identify the service principal, and the `credential`\noneof proves that identity, exchanged for an Entra bearer token on outbound\nrequests via the OAuth2 client-credentials grant. Shared by the Azure OpenAI\nand Microsoft Foundry provider configs.", + "properties": { + "client_id": { + "description": "[Beta] Entra ID client (application) ID. Required on Create.", + "$ref": "#/$defs/string", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "client_secret": { + "description": "[Beta] Entra ID client secret. Supplied as inline plaintext via\n`ProviderSecret.plaintext`.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "tenant_id": { + "description": "[Beta] Entra ID (Azure AD) tenant ID. Required on Create.", + "$ref": "#/$defs/string", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigExternalModelProviderType": { + "oneOf": [ + { + "type": "string", + "description": "External LLM provider for an EXTERNAL_FOUNDATION_MODEL destination.", + "enum": [ + "EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI", + "EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI", + "EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC", + "EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK", + "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM", + "EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY", + "EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE" + ], + "enumDescriptions": [ + "[Beta]", + "[Beta]", + "[Beta]", + "[Beta]", + "[Beta]", + "[Beta]", + "[Beta]" + ] + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigGeminiEnterpriseProviderConfig": { + "oneOf": [ + { + "type": "object", + "description": "Gemini Enterprise provider configuration.", + "properties": { + "direct": { + "description": "[Beta] Direct form of Gemini Enterprise provider config.\n\nAuthentication is one of two mutually exclusive modes; exactly one must be\nsupplied on Create:\n- API key: set `api_key`, leave `service_credential` unset.\n- UC service credential: set `service_credential`, leave `api_key` unset.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig": { + "oneOf": [ + { + "type": "object", + "description": "Direct form of Gemini Enterprise provider config.\n\nAuthentication is one of two mutually exclusive modes; exactly one must be\nsupplied on Create:\n- API key: set `api_key`, leave `service_credential` unset.\n- UC service credential: set `service_credential`, leave `api_key` unset.", + "properties": { + "api_key": { + "description": "[Beta] Google Gemini Enterprise API key. Required on Create when using API-key\nauth; mutually exclusive with `service_credential`. Supplied as inline\nplaintext via `ProviderSecret.plaintext`.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "project_id": { + "description": "[Beta] GCP project ID hosting the Gemini Enterprise endpoint. Required on Create.", + "$ref": "#/$defs/string", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "region": { + "description": "[Beta] GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`).\nRequired on Create.", + "$ref": "#/$defs/string", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigMicrosoftFoundryProviderConfig": { + "oneOf": [ + { + "type": "object", + "description": "Microsoft Foundry provider configuration.", + "properties": { + "direct": { + "description": "[Beta] Direct form of Microsoft Foundry provider config.\n\nAuthentication is one of three mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset. AI Gateway exchanges these for\nan Entra bearer token on outbound requests via the OAuth2\nclient-credentials grant.\n- UC service credential: set `service_credential.name` to the AIP-122\nresource-name form `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in UC and is\nreferenced by name, not held on this message. Only supported on\nAzure-hosted workspaces.\nSetting more than one mode is rejected.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig": { + "oneOf": [ + { + "type": "object", + "description": "Direct form of Microsoft Foundry provider config.\n\nAuthentication is one of three mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset. AI Gateway exchanges these for\nan Entra bearer token on outbound requests via the OAuth2\nclient-credentials grant.\n- UC service credential: set `service_credential.name` to the AIP-122\nresource-name form `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in UC and is\nreferenced by name, not held on this message. Only supported on\nAzure-hosted workspaces.\nSetting more than one mode is rejected.", + "properties": { + "api_key": { + "description": "[Beta] Microsoft AI Foundry API key. Mutually exclusive with the Entra and\nservice-credential modes. Supplied as inline plaintext via\n`ProviderSecret.plaintext`.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "base_url": { + "description": "[Beta] Microsoft AI Foundry endpoint URL. Required on Create.", + "$ref": "#/$defs/string", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "entra_service_principal": { + "description": "[Beta] Entra ID (service principal) auth. Mutually exclusive with `api_key` and\n`service_credential`.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigEntraServicePrincipal", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "service_credential": { + "description": "[Beta] Reference to a UC service credential authorizing Microsoft Foundry requests.\nOn Create the caller supplies `service_credential.name` in the AIP-122\nresource-name form `credentials/{name}`. Required on Create when using\nUC-service-credential auth; mutually exclusive with `api_key` and\n`entra_service_principal`. The credential is\nreferenced by name; its value is not carried here. On read the resolved `id`\nand `is_deleted` are also populated. Only supported on Azure-hosted\nworkspaces; Create requests from other clouds are rejected with\nINVALID_PARAMETER_VALUE.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigServiceCredential", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, "catalog.ModelProviderServiceConfigModelTargetConfig": { "oneOf": [ { @@ -5520,6 +6071,99 @@ } ] }, + "catalog.ModelProviderServiceConfigOpenAiProviderConfig": { + "oneOf": [ + { + "type": "object", + "description": "OpenAI provider configuration.", + "properties": { + "direct": { + "description": "[Beta] Direct (inline-credentials) form of the OpenAI provider config.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigOpenAiProviderDirectConfig", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigOpenAiProviderDirectConfig": { + "oneOf": [ + { + "type": "object", + "description": "Direct (inline-credentials) form of the OpenAI provider config.", + "properties": { + "api_key": { + "description": "[Beta] OpenAI API key. Required on Create. Supplied as inline plaintext via\n`ProviderSecret.plaintext`.", + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "base_url": { + "description": "[Beta] Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for\nOpenAI-API-compatible third-party endpoints or in-network proxies.", + "$ref": "#/$defs/string", + "x-databricks-launch-stage": "PUBLIC_BETA" + }, + "organization": { + "description": "[Beta] Optional OpenAI organization ID. When set, the platform forwards it as\nthe `OpenAI-Organization` header.", + "$ref": "#/$defs/string", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigProviderSecret": { + "oneOf": [ + { + "type": "object", + "description": "A secret value supplied as part of an inline provider config. The caller\nsupplies the value as inline `plaintext` on writes; the platform stores it\nencrypted. The `plaintext` field is `INPUT_ONLY` and never round-trips on\nreads.", + "properties": { + "plaintext": { + "description": "[Beta] Inline plaintext credential. INPUT_ONLY: the value never round-trips on\nreads. Get and List responses omit `plaintext`; the field's presence in\nthe read shape only indicates that a secret is configured.", + "$ref": "#/$defs/string", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, + "catalog.ModelProviderServiceConfigServiceCredential": { + "oneOf": [ + { + "type": "object", + "description": "---- Provider configuration (nested; see the `provider` oneof below) ----\nThe customer-owned UC service credential a ModelProviderService uses to\nauthenticate to its provider, referenced by name.", + "properties": { + "name": { + "description": "[Beta] Resource name of the bound UC service credential, in the AIP-122 form\n`credentials/{name}` (a metastore-level single-part credential name). On\ncreate the caller supplies the name here. On read it reflects the\ncredential's current name at read time.", + "$ref": "#/$defs/string", + "x-databricks-launch-stage": "PUBLIC_BETA" + } + }, + "additionalProperties": false, + "required": [ + "name" + ] + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, "catalog.ModelServiceConfig": { "oneOf": [ { @@ -17300,6 +17944,20 @@ } ] }, + "resources.ModelProviderService": { + "oneOf": [ + { + "type": "object", + "additionalProperties": { + "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.ModelProviderService" + } + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, "resources.ModelService": { "oneOf": [ { @@ -17975,6 +18633,20 @@ } ] }, + "catalog.ModelProviderServiceConfigModelTargetConfig": { + "oneOf": [ + { + "type": "array", + "items": { + "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigModelTargetConfig" + } + }, + { + "type": "string", + "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" + } + ] + }, "catalog.ModelServiceConfigDestinationConfig": { "oneOf": [ { diff --git a/bundle/statemgmt/state_load_test.go b/bundle/statemgmt/state_load_test.go index 0a0dafee39f..b03ff469284 100644 --- a/bundle/statemgmt/state_load_test.go +++ b/bundle/statemgmt/state_load_test.go @@ -34,6 +34,7 @@ func TestStateToBundleEmptyLocalResources(t *testing.T) { "resources.model_serving_endpoints.test_model_serving": {ID: "1"}, "resources.model_services.test_model_service": {ID: "main.default.test_model_service"}, "resources.mcp_services.test_mcp_service": {ID: "main.default.test_mcp_service"}, + "resources.model_provider_services.test_model_provider_service": {ID: "main.default.test_model_provider_service"}, "resources.registered_models.test_registered_model": {ID: "1"}, "resources.quality_monitors.test_monitor": {ID: "1"}, "resources.catalogs.test_catalog": {ID: "1"}, @@ -171,7 +172,9 @@ func TestStateToBundleEmptyLocalResources(t *testing.T) { assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.ModelServices["test_model_service"].ModifiedStatus) assert.Equal(t, "main.default.test_mcp_service", config.Resources.McpServices["test_mcp_service"].ID) + assert.Equal(t, "main.default.test_model_provider_service", config.Resources.ModelProviderServices["test_model_provider_service"].ID) assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.McpServices["test_mcp_service"].ModifiedStatus) + assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.ModelProviderServices["test_model_provider_service"].ModifiedStatus) AssertFullResourceCoverage(t, &config) } @@ -448,6 +451,14 @@ func TestStateToBundleEmptyRemoteResources(t *testing.T) { }, }, }, + ModelProviderServices: map[string]*resources.ModelProviderService{ + "test_model_provider_service": { + ModelProviderServiceConfig: resources.ModelProviderServiceConfig{ + Parent: "schemas/main.default", + ModelProviderServiceId: "test_model_provider_service", + }, + }, + }, }, } @@ -563,7 +574,9 @@ func TestStateToBundleEmptyRemoteResources(t *testing.T) { assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.ModelServices["test_model_service"].ModifiedStatus) assert.Empty(t, config.Resources.McpServices["test_mcp_service"].ID) + assert.Empty(t, config.Resources.ModelProviderServices["test_model_provider_service"].ID) assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.McpServices["test_mcp_service"].ModifiedStatus) + assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.ModelProviderServices["test_model_provider_service"].ModifiedStatus) AssertFullResourceCoverage(t, &config) } @@ -1019,6 +1032,20 @@ func TestStateToBundleModifiedResources(t *testing.T) { }, }, }, + ModelProviderServices: map[string]*resources.ModelProviderService{ + "test_model_provider_service": { + ModelProviderServiceConfig: resources.ModelProviderServiceConfig{ + Parent: "schemas/main.default", + ModelProviderServiceId: "test_model_provider_service", + }, + }, + "test_model_provider_service_new": { + ModelProviderServiceConfig: resources.ModelProviderServiceConfig{ + Parent: "schemas/main.default", + ModelProviderServiceId: "test_model_provider_service_new", + }, + }, + }, }, } state := ExportedResourcesMap{ @@ -1083,7 +1110,9 @@ func TestStateToBundleModifiedResources(t *testing.T) { "resources.model_services.test_model_service": {ID: "main.default.test_model_service"}, "resources.model_services.test_model_service_old": {ID: "main.default.test_model_service_old"}, "resources.mcp_services.test_mcp_service": {ID: "main.default.test_mcp_service"}, + "resources.model_provider_services.test_model_provider_service": {ID: "main.default.test_model_provider_service"}, "resources.mcp_services.test_mcp_service_old": {ID: "main.default.test_mcp_service_old"}, + "resources.model_provider_services.test_model_provider_service_old": {ID: "main.default.test_model_provider_service_old"}, "resources.secrets.test_secret": {ID: "main.default.test_secret"}, "resources.secrets.test_secret_old": {ID: "main.default.test_secret_old"}, } @@ -1303,11 +1332,17 @@ func TestStateToBundleModifiedResources(t *testing.T) { assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.ModelServices["test_model_service_new"].ModifiedStatus) assert.Equal(t, "main.default.test_mcp_service", config.Resources.McpServices["test_mcp_service"].ID) + assert.Equal(t, "main.default.test_model_provider_service", config.Resources.ModelProviderServices["test_model_provider_service"].ID) assert.Empty(t, config.Resources.McpServices["test_mcp_service"].ModifiedStatus) + assert.Empty(t, config.Resources.ModelProviderServices["test_model_provider_service"].ModifiedStatus) assert.Equal(t, "main.default.test_mcp_service_old", config.Resources.McpServices["test_mcp_service_old"].ID) + assert.Equal(t, "main.default.test_model_provider_service_old", config.Resources.ModelProviderServices["test_model_provider_service_old"].ID) assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.McpServices["test_mcp_service_old"].ModifiedStatus) + assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.ModelProviderServices["test_model_provider_service_old"].ModifiedStatus) assert.Empty(t, config.Resources.McpServices["test_mcp_service_new"].ID) + assert.Empty(t, config.Resources.ModelProviderServices["test_model_provider_service_new"].ID) assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.McpServices["test_mcp_service_new"].ModifiedStatus) + assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.ModelProviderServices["test_model_provider_service_new"].ModifiedStatus) assert.Equal(t, "main.default.test_secret", config.Resources.Secrets["test_secret"].ID) assert.Empty(t, config.Resources.Secrets["test_secret"].ModifiedStatus) diff --git a/cmd/experimental/workspace_open_test.go b/cmd/experimental/workspace_open_test.go index 94e7b558998..24f9d49c79b 100644 --- a/cmd/experimental/workspace_open_test.go +++ b/cmd/experimental/workspace_open_test.go @@ -67,7 +67,7 @@ func TestBuildWorkspaceURLFragmentBasedResources(t *testing.T) { func TestBuildWorkspaceURLUnknownResourceType(t *testing.T) { _, err := workspaceurls.BuildResourceURL("https://myworkspace.databricks.com", "unknown", "123", "") assert.ErrorContains(t, err, "unknown resource type \"unknown\"") - assert.ErrorContains(t, err, "alerts, apps, catalogs, cluster_policies, clusters, dashboards, database_catalogs, database_instances, experiments, genie_spaces, instance_pools, jobs, mcp_services, model_services, model_serving_endpoints, models, notebooks, pipelines, postgres_catalogs, postgres_synced_tables, quality_monitors, queries, registered_models, schemas, secrets, synced_database_tables, vector_search_endpoints, vector_search_indexes, volumes, warehouses") + assert.ErrorContains(t, err, "alerts, apps, catalogs, cluster_policies, clusters, dashboards, database_catalogs, database_instances, experiments, genie_spaces, instance_pools, jobs, mcp_services, model_provider_services, model_services, model_serving_endpoints, models, notebooks, pipelines, postgres_catalogs, postgres_synced_tables, quality_monitors, queries, registered_models, schemas, secrets, synced_database_tables, vector_search_endpoints, vector_search_indexes, volumes, warehouses") } func TestBuildWorkspaceURLHostWithTrailingSlash(t *testing.T) { @@ -120,6 +120,7 @@ func TestWorkspaceOpenCommandCompletion(t *testing.T) { "instance_pools", "jobs", "mcp_services", + "model_provider_services", "model_services", "model_serving_endpoints", "models", @@ -151,7 +152,7 @@ func TestWorkspaceOpenCommandCompletionSecondArg(t *testing.T) { func TestWorkspaceOpenCommandHelpText(t *testing.T) { cmd := newWorkspaceOpenCommand() - assert.Contains(t, cmd.Long, "Supported resource types: alerts, apps, catalogs, cluster_policies, clusters, dashboards, database_catalogs, database_instances, experiments, genie_spaces, instance_pools, jobs, mcp_services, model_services, model_serving_endpoints, models, notebooks, pipelines, postgres_catalogs, postgres_synced_tables, quality_monitors, queries, registered_models, schemas, secrets, synced_database_tables, vector_search_endpoints, vector_search_indexes, volumes, warehouses.") + assert.Contains(t, cmd.Long, "Supported resource types: alerts, apps, catalogs, cluster_policies, clusters, dashboards, database_catalogs, database_instances, experiments, genie_spaces, instance_pools, jobs, mcp_services, model_provider_services, model_services, model_serving_endpoints, models, notebooks, pipelines, postgres_catalogs, postgres_synced_tables, quality_monitors, queries, registered_models, schemas, secrets, synced_database_tables, vector_search_endpoints, vector_search_indexes, volumes, warehouses.") assert.Contains(t, cmd.Long, "databricks experimental open jobs 123456789") assert.Contains(t, cmd.Long, "databricks experimental open notebooks /Users/user@example.com/my-notebook") assert.Contains(t, cmd.Long, "databricks experimental open registered_models catalog.schema.my_model") diff --git a/libs/testserver/fake_workspace.go b/libs/testserver/fake_workspace.go index 7786e7b1492..20543297b87 100644 --- a/libs/testserver/fake_workspace.go +++ b/libs/testserver/fake_workspace.go @@ -206,6 +206,7 @@ type FakeWorkspace struct { RegisteredModels map[string]catalog.RegisteredModelInfo ModelServices map[string]catalog.ModelService McpServices map[string]catalog.McpService + ModelProviderServices map[string]catalog.ModelProviderService ServingEndpoints map[string]serving.ServingEndpointDetailed VectorSearchEndpoints map[string]vectorsearch.EndpointInfo VectorSearchIndexes map[string]fakeVectorSearchIndex @@ -468,25 +469,26 @@ func NewFakeWorkspace(url, token string) *FakeWorkspace { files: make(map[string]FileEntry), repoIdByPath: make(map[string]int64), - Jobs: map[int64]jobs.Job{}, - JobRuns: map[int64]jobs.Run{}, - JobRunOutputs: map[int64]jobs.RunOutput{}, - JobRunIdempotency: map[string]int64{}, - Grants: map[string][]catalog.PrivilegeAssignment{}, - Pipelines: map[string]pipelines.GetPipelineResponse{}, - PipelineUpdates: map[string]bool{}, - Monitors: map[string]catalog.MonitorInfo{}, - Apps: map[string]apps.App{}, - Catalogs: map[string]catalog.CatalogInfo{}, - ExternalLocations: map[string]catalog.ExternalLocationInfo{}, - Schemas: map[string]catalog.SchemaInfo{}, - RegisteredModels: map[string]catalog.RegisteredModelInfo{}, - ModelServices: map[string]catalog.ModelService{}, - McpServices: map[string]catalog.McpService{}, - Volumes: map[string]catalog.VolumeInfo{}, - Dashboards: NewEventualMap[string, *fakeDashboard](strings.HasPrefix(token, EventualConsistencyTokenPrefix)), - PublishedDashboards: map[string]dashboards.PublishedDashboard{}, - GenieSpaces: map[string]dashboards.GenieSpace{}, + Jobs: map[int64]jobs.Job{}, + JobRuns: map[int64]jobs.Run{}, + JobRunOutputs: map[int64]jobs.RunOutput{}, + JobRunIdempotency: map[string]int64{}, + Grants: map[string][]catalog.PrivilegeAssignment{}, + Pipelines: map[string]pipelines.GetPipelineResponse{}, + PipelineUpdates: map[string]bool{}, + Monitors: map[string]catalog.MonitorInfo{}, + Apps: map[string]apps.App{}, + Catalogs: map[string]catalog.CatalogInfo{}, + ExternalLocations: map[string]catalog.ExternalLocationInfo{}, + Schemas: map[string]catalog.SchemaInfo{}, + RegisteredModels: map[string]catalog.RegisteredModelInfo{}, + ModelServices: map[string]catalog.ModelService{}, + McpServices: map[string]catalog.McpService{}, + ModelProviderServices: map[string]catalog.ModelProviderService{}, + Volumes: map[string]catalog.VolumeInfo{}, + Dashboards: NewEventualMap[string, *fakeDashboard](strings.HasPrefix(token, EventualConsistencyTokenPrefix)), + PublishedDashboards: map[string]dashboards.PublishedDashboard{}, + GenieSpaces: map[string]dashboards.GenieSpace{}, SqlWarehouses: map[string]sql.GetWarehouseResponse{ TestDefaultWarehouseId: { Id: TestDefaultWarehouseId, diff --git a/libs/testserver/handlers.go b/libs/testserver/handlers.go index be085e098e9..15aa89e9bdf 100644 --- a/libs/testserver/handlers.go +++ b/libs/testserver/handlers.go @@ -664,6 +664,24 @@ func AddDefaultHandlers(server *Server) { return MapDelete(req.Workspace, req.Workspace.McpServices, req.Vars["name"]) }) + // Model Provider Services (AI Gateway): + + server.Handle("POST", "/api/2.1/unity-catalog/model-provider-services", func(req Request) any { + return req.Workspace.ModelProviderServicesCreate(req) + }) + + server.Handle("GET", "/api/2.1/unity-catalog/model-provider-services/{name}", func(req Request) any { + return MapGet(req.Workspace, req.Workspace.ModelProviderServices, req.Vars["name"]) + }) + + server.Handle("PATCH", "/api/2.1/unity-catalog/model-provider-services/{name}", func(req Request) any { + return req.Workspace.ModelProviderServicesUpdate(req, req.Vars["name"]) + }) + + server.Handle("DELETE", "/api/2.1/unity-catalog/model-provider-services/{name}", func(req Request) any { + return MapDelete(req.Workspace, req.Workspace.ModelProviderServices, req.Vars["name"]) + }) + // Volumes: server.Handle("GET", "/api/2.1/unity-catalog/volumes/{full_name}", func(req Request) any { diff --git a/libs/testserver/model_provider_services.go b/libs/testserver/model_provider_services.go new file mode 100644 index 00000000000..622bf75888c --- /dev/null +++ b/libs/testserver/model_provider_services.go @@ -0,0 +1,70 @@ +package testserver + +import ( + "encoding/json" + "fmt" + "net/http" + "strings" + + "github.com/databricks/databricks-sdk-go/service/catalog" +) + +// ModelProviderServicesCreate fakes POST +// /api/2.1/unity-catalog/model-provider-services. See ModelServicesCreate for +// the shape: the ModelProviderService body is sent directly, parent and +// model_provider_service_id are query parameters, and the map is keyed by the +// {catalog}.{schema}.{model_provider_service} path segment. +func (s *FakeWorkspace) ModelProviderServicesCreate(req Request) Response { + defer s.LockUnlock()() + + var ms catalog.ModelProviderService + if err := json.Unmarshal(req.Body, &ms); err != nil { + return Response{ + Body: fmt.Sprintf("internal error: %s", err), + StatusCode: http.StatusInternalServerError, + } + } + + schema := strings.TrimPrefix(req.URL.Query().Get("parent"), "schemas/") + key := schema + "." + req.URL.Query().Get("model_provider_service_id") + + ms.Name = "model-provider-services/" + key + ms.CreatedBy = s.CurrentUser().UserName + ms.UpdatedBy = s.CurrentUser().UserName + ms.EffectiveOwner = s.CurrentUser().UserName + ms.MetastoreId = nextUUID() + + s.ModelProviderServices[key] = ms + return Response{ + Body: ms, + } +} + +func (s *FakeWorkspace) ModelProviderServicesUpdate(req Request, name string) Response { + defer s.LockUnlock()() + + existing, ok := s.ModelProviderServices[name] + if !ok { + return Response{ + StatusCode: http.StatusNotFound, + Body: fmt.Sprintf("model provider service %s not found", name), + } + } + + var incoming catalog.ModelProviderService + if err := json.Unmarshal(req.Body, &incoming); err != nil { + return Response{ + Body: fmt.Sprintf("internal error: %s", err), + StatusCode: http.StatusInternalServerError, + } + } + + existing.Comment = incoming.Comment + existing.Config = incoming.Config + existing.UpdatedBy = s.CurrentUser().UserName + + s.ModelProviderServices[name] = existing + return Response{ + Body: existing, + } +} diff --git a/libs/workspaceurls/urls.go b/libs/workspaceurls/urls.go index 3bbf1339de4..534bdc0fc83 100644 --- a/libs/workspaceurls/urls.go +++ b/libs/workspaceurls/urls.go @@ -24,6 +24,7 @@ var resourceURLPatterns = map[string]string{ "models": "ml/models/%s", "model_serving_endpoints": "ml/endpoints/%s", "model_services": "explore/data/model-services/%s", + "model_provider_services": "explore/data/model-provider-services/%s", "notebooks": "#notebook/%s", "pipelines": "pipelines/%s", "postgres_catalogs": "explore/data/%s", @@ -54,16 +55,17 @@ var resourceAliases = map[string]string{ // provided as a dot-separated name (e.g. "catalog.schema.model") but the URL // requires slash-separated segments. var dotSeparatedResources = map[string]bool{ - "catalogs": true, - "mcp_services": true, - "model_services": true, - "postgres_synced_tables": true, - "quality_monitors": true, - "registered_models": true, - "schemas": true, - "secrets": true, - "vector_search_indexes": true, - "volumes": true, + "catalogs": true, + "mcp_services": true, + "model_services": true, + "model_provider_services": true, + "postgres_synced_tables": true, + "quality_monitors": true, + "registered_models": true, + "schemas": true, + "secrets": true, + "vector_search_indexes": true, + "volumes": true, } // ResourceTypes returns a sorted list of all supported resource type names. diff --git a/python/databricks/bundles/core/__init__.py b/python/databricks/bundles/core/__init__.py index d66f21260ed..5d4d576ed47 100644 --- a/python/databricks/bundles/core/__init__.py +++ b/python/databricks/bundles/core/__init__.py @@ -31,6 +31,7 @@ "mcp_service_mutator", "mlflow_experiment_mutator", "mlflow_model_mutator", + "model_provider_service_mutator", "model_service_mutator", "model_serving_endpoint_mutator", "pipeline_mutator", @@ -68,6 +69,7 @@ mcp_service_mutator, mlflow_experiment_mutator, mlflow_model_mutator, + model_provider_service_mutator, model_service_mutator, model_serving_endpoint_mutator, pipeline_mutator, diff --git a/python/databricks/bundles/core/_generated/__init__.py b/python/databricks/bundles/core/_generated/__init__.py index 7b3c3bc985e..c9a140ab5f5 100644 --- a/python/databricks/bundles/core/_generated/__init__.py +++ b/python/databricks/bundles/core/_generated/__init__.py @@ -41,6 +41,10 @@ _McpServiceResources, mcp_service_mutator, ) +from databricks.bundles.core._generated.model_provider_services import ( + _ModelProviderServiceResources, + model_provider_service_mutator, +) from databricks.bundles.core._generated.model_services import ( _ModelServiceResources, model_service_mutator, @@ -112,6 +116,7 @@ "mcp_service_mutator", "mlflow_experiment_mutator", "mlflow_model_mutator", + "model_provider_service_mutator", "model_service_mutator", "model_serving_endpoint_mutator", "pipeline_mutator", @@ -142,6 +147,7 @@ class _GeneratedResources( _JobRunResources, _JobResources, _McpServiceResources, + _ModelProviderServiceResources, _ModelServiceResources, _ModelServingEndpointResources, _MlflowModelResources, @@ -175,6 +181,7 @@ def _all_resource_types() -> "tuple[_ResourceType, ...]": job_runs, jobs, mcp_services, + model_provider_services, model_services, model_serving_endpoints, models, @@ -205,6 +212,7 @@ def _all_resource_types() -> "tuple[_ResourceType, ...]": job_runs._resource_type(), jobs._resource_type(), mcp_services._resource_type(), + model_provider_services._resource_type(), model_services._resource_type(), model_serving_endpoints._resource_type(), models._resource_type(), diff --git a/python/databricks/bundles/core/_generated/model_provider_services.py b/python/databricks/bundles/core/_generated/model_provider_services.py new file mode 100644 index 00000000000..89f5b631fcc --- /dev/null +++ b/python/databricks/bundles/core/_generated/model_provider_services.py @@ -0,0 +1,130 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from collections.abc import Callable +from typing import TYPE_CHECKING, Optional, overload + +from databricks.bundles.core._bundle import Bundle +from databricks.bundles.core._location import Location +from databricks.bundles.core._resource_mutator import ResourceMutator +from databricks.bundles.core._transform import _transform + +if TYPE_CHECKING: + from databricks.bundles.core._resource_type import _ResourceType + from databricks.bundles.model_provider_services._models.model_provider_service import ( + ModelProviderService, + ModelProviderServiceParam, + ) + + +def _resource_type() -> "_ResourceType": + from databricks.bundles.core._resource_type import _ResourceType + from databricks.bundles.model_provider_services._models.model_provider_service import ( + ModelProviderService, + ) + + return _ResourceType( + resource_type=ModelProviderService, + singular_name="model_provider_service", + plural_name="model_provider_services", + ) + + +class _ModelProviderServiceResources: + """ + Generated model_provider_service accessors, mixed into Resources. + """ + + # Provided by the Resources subclass; declared here so the generated methods + # below type-check. + _resources: dict[str, dict] + + if TYPE_CHECKING: + + def add_location(self, path: tuple[str, ...], location: Location) -> None: ... + + def add_diagnostic_error( + self, + msg: str, + *, + detail: Optional[str] = None, + path: Optional[tuple[str, ...]] = None, + location: Optional[Location] = None, + ) -> None: ... + + @property + def model_provider_services(self) -> dict[str, "ModelProviderService"]: + return self._resources["model_provider_services"] + + def add_model_provider_service( + self, + resource_name: str, + model_provider_service: "ModelProviderServiceParam", + *, + location: Optional[Location] = None, + ) -> None: + """ + Adds the resource model_provider_service to the collection of resources. Resource name must be unique across all model_provider_services. + + :param resource_name: unique identifier for the model_provider_service + :param model_provider_service: the model_provider_service to add, can be ModelProviderService or dict + :param location: optional location of the model_provider_service in the source code + """ + from databricks.bundles.model_provider_services._models.model_provider_service import ( + ModelProviderService, + ) + + model_provider_service = _transform( + ModelProviderService, model_provider_service + ) + path = ("resources", "model_provider_services", resource_name) + location = location or Location.from_stack_frame(depth=1) + + if self._resources["model_provider_services"].get(resource_name): + self.add_diagnostic_error( + msg=f"Duplicate resource name '{resource_name}' for resource 'model_provider_service'. Resource names must be unique.", + location=location, + path=path, + ) + else: + if location: + self.add_location(path, location) + + self._resources["model_provider_services"][resource_name] = ( + model_provider_service + ) + + +@overload +def model_provider_service_mutator( + function: Callable[[Bundle, "ModelProviderService"], "ModelProviderService"], +) -> ResourceMutator["ModelProviderService"]: ... + + +@overload +def model_provider_service_mutator( + function: Callable[["ModelProviderService"], "ModelProviderService"], +) -> ResourceMutator["ModelProviderService"]: ... + + +def model_provider_service_mutator( + function: Callable, +) -> ResourceMutator["ModelProviderService"]: + """ + Decorator for defining mutator for model_provider_services. Function should return a new instance of the model_provider_service + with the desired changes, instead of mutating the input model_provider_service. + + Example: + + .. code-block:: python + + @model_provider_service_mutator + def my_model_provider_service_mutator(bundle: Bundle, model_provider_service: ModelProviderService) -> ModelProviderService: + return replace(model_provider_service, ...) + + :param function: Function that mutates model_provider_services. + """ + from databricks.bundles.model_provider_services._models.model_provider_service import ( + ModelProviderService, + ) + + return ResourceMutator(resource_type=ModelProviderService, function=function) diff --git a/python/databricks/bundles/model_provider_services/__init__.py b/python/databricks/bundles/model_provider_services/__init__.py new file mode 100644 index 00000000000..5231f6440d3 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/__init__.py @@ -0,0 +1,230 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +__all__ = [ + "InferenceTableConfig", + "InferenceTableConfigDict", + "InferenceTableConfigParam", + "Lifecycle", + "LifecycleDict", + "LifecycleParam", + "ModelProviderService", + "ModelProviderServiceConfig", + "ModelProviderServiceConfigAmazonBedrockProviderConfig", + "ModelProviderServiceConfigAmazonBedrockProviderConfigDict", + "ModelProviderServiceConfigAmazonBedrockProviderConfigParam", + "ModelProviderServiceConfigAmazonBedrockProviderDirectConfig", + "ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict", + "ModelProviderServiceConfigAmazonBedrockProviderDirectConfigParam", + "ModelProviderServiceConfigAnthropicProviderConfig", + "ModelProviderServiceConfigAnthropicProviderConfigDict", + "ModelProviderServiceConfigAnthropicProviderConfigParam", + "ModelProviderServiceConfigAnthropicProviderDirectConfig", + "ModelProviderServiceConfigAnthropicProviderDirectConfigDict", + "ModelProviderServiceConfigAnthropicProviderDirectConfigParam", + "ModelProviderServiceConfigAnthropicProviderRelayedConfig", + "ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType", + "ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanTypeParam", + "ModelProviderServiceConfigAnthropicProviderRelayedConfigDict", + "ModelProviderServiceConfigAnthropicProviderRelayedConfigParam", + "ModelProviderServiceConfigAwsAccessKey", + "ModelProviderServiceConfigAwsAccessKeyDict", + "ModelProviderServiceConfigAwsAccessKeyParam", + "ModelProviderServiceConfigAzureOpenAiProviderConfig", + "ModelProviderServiceConfigAzureOpenAiProviderConfigDict", + "ModelProviderServiceConfigAzureOpenAiProviderConfigParam", + "ModelProviderServiceConfigAzureOpenAiProviderDirectConfig", + "ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict", + "ModelProviderServiceConfigAzureOpenAiProviderDirectConfigParam", + "ModelProviderServiceConfigCustomProviderConfig", + "ModelProviderServiceConfigCustomProviderConfigDict", + "ModelProviderServiceConfigCustomProviderConfigParam", + "ModelProviderServiceConfigCustomProviderDirectConfig", + "ModelProviderServiceConfigCustomProviderDirectConfigDict", + "ModelProviderServiceConfigCustomProviderDirectConfigParam", + "ModelProviderServiceConfigDict", + "ModelProviderServiceConfigEntraServicePrincipal", + "ModelProviderServiceConfigEntraServicePrincipalDict", + "ModelProviderServiceConfigEntraServicePrincipalParam", + "ModelProviderServiceConfigExternalModelProviderType", + "ModelProviderServiceConfigExternalModelProviderTypeParam", + "ModelProviderServiceConfigGeminiEnterpriseProviderConfig", + "ModelProviderServiceConfigGeminiEnterpriseProviderConfigDict", + "ModelProviderServiceConfigGeminiEnterpriseProviderConfigParam", + "ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig", + "ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigDict", + "ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigParam", + "ModelProviderServiceConfigMicrosoftFoundryProviderConfig", + "ModelProviderServiceConfigMicrosoftFoundryProviderConfigDict", + "ModelProviderServiceConfigMicrosoftFoundryProviderConfigParam", + "ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig", + "ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict", + "ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigParam", + "ModelProviderServiceConfigModelTargetConfig", + "ModelProviderServiceConfigModelTargetConfigDict", + "ModelProviderServiceConfigModelTargetConfigParam", + "ModelProviderServiceConfigOpenAiProviderConfig", + "ModelProviderServiceConfigOpenAiProviderConfigDict", + "ModelProviderServiceConfigOpenAiProviderConfigParam", + "ModelProviderServiceConfigOpenAiProviderDirectConfig", + "ModelProviderServiceConfigOpenAiProviderDirectConfigDict", + "ModelProviderServiceConfigOpenAiProviderDirectConfigParam", + "ModelProviderServiceConfigParam", + "ModelProviderServiceConfigProviderSecret", + "ModelProviderServiceConfigProviderSecretDict", + "ModelProviderServiceConfigProviderSecretParam", + "ModelProviderServiceConfigServiceCredential", + "ModelProviderServiceConfigServiceCredentialDict", + "ModelProviderServiceConfigServiceCredentialParam", + "ModelProviderServiceDict", + "ModelProviderServiceParam", + "RateLimit", + "RateLimitDict", + "RateLimitParam", + "RateLimitRateLimitKey", + "RateLimitRateLimitKeyParam", + "RateLimitRateLimitRenewalPeriod", + "RateLimitRateLimitRenewalPeriodParam", +] + + +from databricks.bundles.model_provider_services._models.inference_table_config import ( + InferenceTableConfig, + InferenceTableConfigDict, + InferenceTableConfigParam, +) +from databricks.bundles.model_provider_services._models.lifecycle import ( + Lifecycle, + LifecycleDict, + LifecycleParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service import ( + ModelProviderService, + ModelProviderServiceDict, + ModelProviderServiceParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config import ( + ModelProviderServiceConfig, + ModelProviderServiceConfigDict, + ModelProviderServiceConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_amazon_bedrock_provider_config import ( + ModelProviderServiceConfigAmazonBedrockProviderConfig, + ModelProviderServiceConfigAmazonBedrockProviderConfigDict, + ModelProviderServiceConfigAmazonBedrockProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_amazon_bedrock_provider_direct_config import ( + ModelProviderServiceConfigAmazonBedrockProviderDirectConfig, + ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict, + ModelProviderServiceConfigAmazonBedrockProviderDirectConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_config import ( + ModelProviderServiceConfigAnthropicProviderConfig, + ModelProviderServiceConfigAnthropicProviderConfigDict, + ModelProviderServiceConfigAnthropicProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_direct_config import ( + ModelProviderServiceConfigAnthropicProviderDirectConfig, + ModelProviderServiceConfigAnthropicProviderDirectConfigDict, + ModelProviderServiceConfigAnthropicProviderDirectConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_relayed_config import ( + ModelProviderServiceConfigAnthropicProviderRelayedConfig, + ModelProviderServiceConfigAnthropicProviderRelayedConfigDict, + ModelProviderServiceConfigAnthropicProviderRelayedConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_relayed_config_anthropic_relayed_plan_type import ( + ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType, + ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanTypeParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_aws_access_key import ( + ModelProviderServiceConfigAwsAccessKey, + ModelProviderServiceConfigAwsAccessKeyDict, + ModelProviderServiceConfigAwsAccessKeyParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_azure_open_ai_provider_config import ( + ModelProviderServiceConfigAzureOpenAiProviderConfig, + ModelProviderServiceConfigAzureOpenAiProviderConfigDict, + ModelProviderServiceConfigAzureOpenAiProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_azure_open_ai_provider_direct_config import ( + ModelProviderServiceConfigAzureOpenAiProviderDirectConfig, + ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict, + ModelProviderServiceConfigAzureOpenAiProviderDirectConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_custom_provider_config import ( + ModelProviderServiceConfigCustomProviderConfig, + ModelProviderServiceConfigCustomProviderConfigDict, + ModelProviderServiceConfigCustomProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_custom_provider_direct_config import ( + ModelProviderServiceConfigCustomProviderDirectConfig, + ModelProviderServiceConfigCustomProviderDirectConfigDict, + ModelProviderServiceConfigCustomProviderDirectConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_entra_service_principal import ( + ModelProviderServiceConfigEntraServicePrincipal, + ModelProviderServiceConfigEntraServicePrincipalDict, + ModelProviderServiceConfigEntraServicePrincipalParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_external_model_provider_type import ( + ModelProviderServiceConfigExternalModelProviderType, + ModelProviderServiceConfigExternalModelProviderTypeParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_gemini_enterprise_provider_config import ( + ModelProviderServiceConfigGeminiEnterpriseProviderConfig, + ModelProviderServiceConfigGeminiEnterpriseProviderConfigDict, + ModelProviderServiceConfigGeminiEnterpriseProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_gemini_enterprise_provider_direct_config import ( + ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig, + ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigDict, + ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_microsoft_foundry_provider_config import ( + ModelProviderServiceConfigMicrosoftFoundryProviderConfig, + ModelProviderServiceConfigMicrosoftFoundryProviderConfigDict, + ModelProviderServiceConfigMicrosoftFoundryProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_microsoft_foundry_provider_direct_config import ( + ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig, + ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict, + ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_model_target_config import ( + ModelProviderServiceConfigModelTargetConfig, + ModelProviderServiceConfigModelTargetConfigDict, + ModelProviderServiceConfigModelTargetConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_open_ai_provider_config import ( + ModelProviderServiceConfigOpenAiProviderConfig, + ModelProviderServiceConfigOpenAiProviderConfigDict, + ModelProviderServiceConfigOpenAiProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_open_ai_provider_direct_config import ( + ModelProviderServiceConfigOpenAiProviderDirectConfig, + ModelProviderServiceConfigOpenAiProviderDirectConfigDict, + ModelProviderServiceConfigOpenAiProviderDirectConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import ( + ModelProviderServiceConfigProviderSecret, + ModelProviderServiceConfigProviderSecretDict, + ModelProviderServiceConfigProviderSecretParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_service_credential import ( + ModelProviderServiceConfigServiceCredential, + ModelProviderServiceConfigServiceCredentialDict, + ModelProviderServiceConfigServiceCredentialParam, +) +from databricks.bundles.model_provider_services._models.rate_limit import ( + RateLimit, + RateLimitDict, + RateLimitParam, +) +from databricks.bundles.model_provider_services._models.rate_limit_rate_limit_key import ( + RateLimitRateLimitKey, + RateLimitRateLimitKeyParam, +) +from databricks.bundles.model_provider_services._models.rate_limit_rate_limit_renewal_period import ( + RateLimitRateLimitRenewalPeriod, + RateLimitRateLimitRenewalPeriodParam, +) diff --git a/python/databricks/bundles/model_provider_services/_models/inference_table_config.py b/python/databricks/bundles/model_provider_services/_models/inference_table_config.py new file mode 100644 index 00000000000..77e4ff25560 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/inference_table_config.py @@ -0,0 +1,104 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOr, VariableOrOptional + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class InferenceTableConfig: + """ + Inference table configuration for payload logging on a model service. + + `parent` is always REQUIRED when the sub-message is set; the destination + UC schema is needed to construct or rebind the payload TABLE regardless of + whether payload logging is currently active. Payload logging is active by + default; set `disabled = true` to pause runtime logging without dropping the + table or the binding. + """ + + parent: VariableOr[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Parent UC schema where the inference table is created. + Format: `schemas/{catalog}.{schema}`. Set at create time and immutable + thereafter; changing it on an existing service is rejected. + """ + + disabled: VariableOrOptional[bool] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Indicates whether payload logging is disabled (opt-out). Unset means that + payload logging is active (the on-by-default state coincides with the proto + zero-value, so the server never fills this field for a client that leaves it + unset). Set `disabled = true` to pause runtime logging while keeping the + sub-message attached (preserving `parent` and `table_name_prefix` for a + later flip back to active). `parent` remains required either way. + """ + + table_name_prefix: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Prefix for the inference-table's UC-registered name. The actual leaf name UC + stores is `_payload`; the `_payload` suffix is appended + automatically. To find the actual UC table after Create, read the `table` + field on the response. Defaults to `_payload` when unset. + Set at create time and immutable thereafter; changing it on an existing + service is rejected. + """ + + @classmethod + def from_dict(cls, value: "InferenceTableConfigDict") -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "InferenceTableConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class InferenceTableConfigDict(TypedDict, total=False): + """""" + + parent: VariableOr[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Parent UC schema where the inference table is created. + Format: `schemas/{catalog}.{schema}`. Set at create time and immutable + thereafter; changing it on an existing service is rejected. + """ + + disabled: VariableOrOptional[bool] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Indicates whether payload logging is disabled (opt-out). Unset means that + payload logging is active (the on-by-default state coincides with the proto + zero-value, so the server never fills this field for a client that leaves it + unset). Set `disabled = true` to pause runtime logging while keeping the + sub-message attached (preserving `parent` and `table_name_prefix` for a + later flip back to active). `parent` remains required either way. + """ + + table_name_prefix: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Prefix for the inference-table's UC-registered name. The actual leaf name UC + stores is `_payload`; the `_payload` suffix is appended + automatically. To find the actual UC table after Create, read the `table` + field on the response. Defaults to `_payload` when unset. + Set at create time and immutable thereafter; changing it on an existing + service is rejected. + """ + + +InferenceTableConfigParam = InferenceTableConfigDict | InferenceTableConfig diff --git a/python/databricks/bundles/model_provider_services/_models/lifecycle.py b/python/databricks/bundles/model_provider_services/_models/lifecycle.py new file mode 100644 index 00000000000..697776a198e --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/lifecycle.py @@ -0,0 +1,40 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class Lifecycle: + """""" + + prevent_destroy: VariableOrOptional[bool] = None + """ + Lifecycle setting to prevent the resource from being destroyed. + """ + + @classmethod + def from_dict(cls, value: "LifecycleDict") -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "LifecycleDict": + return _transform_to_json_value(self) # type:ignore + + +class LifecycleDict(TypedDict, total=False): + """""" + + prevent_destroy: VariableOrOptional[bool] + """ + Lifecycle setting to prevent the resource from being destroyed. + """ + + +LifecycleParam = LifecycleDict | Lifecycle diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service.py new file mode 100644 index 00000000000..65fcb48e421 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service.py @@ -0,0 +1,59 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._resource import Resource +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOr, VariableOrOptional +from databricks.bundles.model_provider_services._models.lifecycle import ( + Lifecycle, + LifecycleParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config import ( + ModelProviderServiceConfig, + ModelProviderServiceConfigParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderService(Resource): + """""" + + model_provider_service_id: VariableOr[str] + + parent: VariableOr[str] + + comment: VariableOrOptional[str] = None + + config: VariableOrOptional[ModelProviderServiceConfig] = None + + lifecycle: VariableOrOptional[Lifecycle] = None + + @classmethod + def from_dict(cls, value: "ModelProviderServiceDict") -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceDict(TypedDict, total=False): + """""" + + model_provider_service_id: VariableOr[str] + + parent: VariableOr[str] + + comment: VariableOrOptional[str] + + config: VariableOrOptional[ModelProviderServiceConfigParam] + + lifecycle: VariableOrOptional[LifecycleParam] + + +ModelProviderServiceParam = ModelProviderServiceDict | ModelProviderService diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config.py new file mode 100644 index 00000000000..c2a769a063f --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config.py @@ -0,0 +1,376 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass, field +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrList, VariableOrOptional +from databricks.bundles.model_provider_services._models.inference_table_config import ( + InferenceTableConfig, + InferenceTableConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_amazon_bedrock_provider_config import ( + ModelProviderServiceConfigAmazonBedrockProviderConfig, + ModelProviderServiceConfigAmazonBedrockProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_config import ( + ModelProviderServiceConfigAnthropicProviderConfig, + ModelProviderServiceConfigAnthropicProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_azure_open_ai_provider_config import ( + ModelProviderServiceConfigAzureOpenAiProviderConfig, + ModelProviderServiceConfigAzureOpenAiProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_custom_provider_config import ( + ModelProviderServiceConfigCustomProviderConfig, + ModelProviderServiceConfigCustomProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_external_model_provider_type import ( + ModelProviderServiceConfigExternalModelProviderType, + ModelProviderServiceConfigExternalModelProviderTypeParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_gemini_enterprise_provider_config import ( + ModelProviderServiceConfigGeminiEnterpriseProviderConfig, + ModelProviderServiceConfigGeminiEnterpriseProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_microsoft_foundry_provider_config import ( + ModelProviderServiceConfigMicrosoftFoundryProviderConfig, + ModelProviderServiceConfigMicrosoftFoundryProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_model_target_config import ( + ModelProviderServiceConfigModelTargetConfig, + ModelProviderServiceConfigModelTargetConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_open_ai_provider_config import ( + ModelProviderServiceConfigOpenAiProviderConfig, + ModelProviderServiceConfigOpenAiProviderConfigParam, +) +from databricks.bundles.model_provider_services._models.rate_limit import ( + RateLimit, + RateLimitParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfig: + """ + Behavioral configuration for a ModelProviderService: provider connection + (auth + provider-specific fields), the catalog of models this provider + service can route to, and the passthrough policy that governs how request + headers, query parameters, and unmanaged subpaths cross the trust boundary + to the upstream provider. + """ + + allow_all_targets: VariableOrOptional[bool] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] When true, accepts any model exposed by the upstream provider; `targets` + is not required and does not restrict routability. When false, only + models listed in `targets` are routable. + """ + + amazon_bedrock: VariableOrOptional[ + ModelProviderServiceConfigAmazonBedrockProviderConfig + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Amazon Bedrock provider configuration. + """ + + anthropic: VariableOrOptional[ModelProviderServiceConfigAnthropicProviderConfig] = ( + None + ) + """ + :meta private: [EXPERIMENTAL] + + [Beta] Anthropic provider configuration. Exactly one of `direct` or `relayed` must + be set on Create; the two are mutually exclusive. + """ + + azure_openai: VariableOrOptional[ + ModelProviderServiceConfigAzureOpenAiProviderConfig + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Azure OpenAI provider configuration. + """ + + custom: VariableOrOptional[ModelProviderServiceConfigCustomProviderConfig] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Custom provider configuration: arbitrary HTTP endpoint with bearer-token auth. + """ + + forward_headers: VariableOrOptional[bool] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Whether to forward incoming request headers to the upstream provider. + Applies to managed (multi-model) requests as well as passthrough requests + served by this provider service. Governance-level decision by the provider + service owner; not selectable per inference call. + """ + + forward_query_parameters: VariableOrOptional[bool] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Whether to forward incoming request query parameters to the upstream + provider. Same trust-boundary semantics as `forward_headers`. + """ + + forward_unmanaged_paths: VariableOrOptional[bool] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Whether to forward request paths that fall outside this service's managed + API set to the upstream provider as opaque passthrough. When true, + requests addressed to subpaths not recognized by the managed API surface + are proxied to the upstream provider over the same provider connection. + When false, only managed-API paths are served. Governance-level decision + by the provider service owner; expanding this expands the trust boundary + that the ModelProviderService exposes. + """ + + gemini_enterprise: VariableOrOptional[ + ModelProviderServiceConfigGeminiEnterpriseProviderConfig + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Gemini Enterprise provider configuration. + """ + + inference_table: VariableOrOptional[InferenceTableConfig] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Inference table configuration for payload logging when this provider + service is invoked directly. When it is invoked through a model service, + the model service's own inference table captures the invocation instead. + Mirrors `ModelServiceConfig.inference_table` / + `AgentServiceConfig.inference_table`. + """ + + microsoft_foundry: VariableOrOptional[ + ModelProviderServiceConfigMicrosoftFoundryProviderConfig + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Microsoft Foundry provider configuration. + """ + + openai: VariableOrOptional[ModelProviderServiceConfigOpenAiProviderConfig] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] OpenAI provider configuration. + """ + + provider_type: VariableOrOptional[ + ModelProviderServiceConfigExternalModelProviderType + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Provider type discriminator. Required at create time; immutable after. + Determines which variant of the `provider` oneof must be set. May not be + changed via Update; attempts to include `config.provider_type` in + `UpdateModelProviderServiceRequest.update_mask` are rejected. + + Required on CreateModelProviderService and immutable thereafter. + """ + + rate_limits: VariableOrList[RateLimit] = field(default_factory=list) + """ + :meta private: [EXPERIMENTAL] + + [Beta] Rate limits applied when this provider service is invoked directly. When + it is invoked through a model service, the model service's own + `rate_limits` apply instead. Mirrors `ModelServiceConfig.rate_limits` / + `McpServiceConfig.rate_limits`. + """ + + targets: VariableOrList[ModelProviderServiceConfigModelTargetConfig] = field( + default_factory=list + ) + """ + :meta private: [EXPERIMENTAL] + + [Beta] Routing targets this provider service exposes (provider-side model + identifier + unified API types per entry). Required (>=1) when + `allow_all_targets = false`; optional and additive when + `allow_all_targets = true`. References from `ExternalModelConfig.target` + must match an entry here unless `allow_all_targets = true`. + """ + + @classmethod + def from_dict(cls, value: "ModelProviderServiceConfigDict") -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigDict(TypedDict, total=False): + """""" + + allow_all_targets: VariableOrOptional[bool] + """ + :meta private: [EXPERIMENTAL] + + [Beta] When true, accepts any model exposed by the upstream provider; `targets` + is not required and does not restrict routability. When false, only + models listed in `targets` are routable. + """ + + amazon_bedrock: VariableOrOptional[ + ModelProviderServiceConfigAmazonBedrockProviderConfigParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Amazon Bedrock provider configuration. + """ + + anthropic: VariableOrOptional[ + ModelProviderServiceConfigAnthropicProviderConfigParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Anthropic provider configuration. Exactly one of `direct` or `relayed` must + be set on Create; the two are mutually exclusive. + """ + + azure_openai: VariableOrOptional[ + ModelProviderServiceConfigAzureOpenAiProviderConfigParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Azure OpenAI provider configuration. + """ + + custom: VariableOrOptional[ModelProviderServiceConfigCustomProviderConfigParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Custom provider configuration: arbitrary HTTP endpoint with bearer-token auth. + """ + + forward_headers: VariableOrOptional[bool] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Whether to forward incoming request headers to the upstream provider. + Applies to managed (multi-model) requests as well as passthrough requests + served by this provider service. Governance-level decision by the provider + service owner; not selectable per inference call. + """ + + forward_query_parameters: VariableOrOptional[bool] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Whether to forward incoming request query parameters to the upstream + provider. Same trust-boundary semantics as `forward_headers`. + """ + + forward_unmanaged_paths: VariableOrOptional[bool] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Whether to forward request paths that fall outside this service's managed + API set to the upstream provider as opaque passthrough. When true, + requests addressed to subpaths not recognized by the managed API surface + are proxied to the upstream provider over the same provider connection. + When false, only managed-API paths are served. Governance-level decision + by the provider service owner; expanding this expands the trust boundary + that the ModelProviderService exposes. + """ + + gemini_enterprise: VariableOrOptional[ + ModelProviderServiceConfigGeminiEnterpriseProviderConfigParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Gemini Enterprise provider configuration. + """ + + inference_table: VariableOrOptional[InferenceTableConfigParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Inference table configuration for payload logging when this provider + service is invoked directly. When it is invoked through a model service, + the model service's own inference table captures the invocation instead. + Mirrors `ModelServiceConfig.inference_table` / + `AgentServiceConfig.inference_table`. + """ + + microsoft_foundry: VariableOrOptional[ + ModelProviderServiceConfigMicrosoftFoundryProviderConfigParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Microsoft Foundry provider configuration. + """ + + openai: VariableOrOptional[ModelProviderServiceConfigOpenAiProviderConfigParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] OpenAI provider configuration. + """ + + provider_type: VariableOrOptional[ + ModelProviderServiceConfigExternalModelProviderTypeParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Provider type discriminator. Required at create time; immutable after. + Determines which variant of the `provider` oneof must be set. May not be + changed via Update; attempts to include `config.provider_type` in + `UpdateModelProviderServiceRequest.update_mask` are rejected. + + Required on CreateModelProviderService and immutable thereafter. + """ + + rate_limits: VariableOrList[RateLimitParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Rate limits applied when this provider service is invoked directly. When + it is invoked through a model service, the model service's own + `rate_limits` apply instead. Mirrors `ModelServiceConfig.rate_limits` / + `McpServiceConfig.rate_limits`. + """ + + targets: VariableOrList[ModelProviderServiceConfigModelTargetConfigParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Routing targets this provider service exposes (provider-side model + identifier + unified API types per entry). Required (>=1) when + `allow_all_targets = false`; optional and additive when + `allow_all_targets = true`. References from `ExternalModelConfig.target` + must match an entry here unless `allow_all_targets = true`. + """ + + +ModelProviderServiceConfigParam = ( + ModelProviderServiceConfigDict | ModelProviderServiceConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_config.py new file mode 100644 index 00000000000..f39c7d53c05 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_config.py @@ -0,0 +1,77 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_amazon_bedrock_provider_direct_config import ( + ModelProviderServiceConfigAmazonBedrockProviderDirectConfig, + ModelProviderServiceConfigAmazonBedrockProviderDirectConfigParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigAmazonBedrockProviderConfig: + """ + Amazon Bedrock provider configuration. + """ + + direct: VariableOrOptional[ + ModelProviderServiceConfigAmazonBedrockProviderDirectConfig + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct form of Amazon Bedrock provider config. + + Authentication is one of two mutually exclusive modes, exactly one of which + must be supplied on Create: + - Access keys: set `aws_access_key`, leave `service_credential` unset. + - UC service credential: set `service_credential.name` to the AIP-122 + resource-name form `credentials/{name}`, leave `aws_access_key` unset. The + credential value lives in UC and is referenced by name, not held on this + message. + Setting more than one mode is rejected. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigAmazonBedrockProviderConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigAmazonBedrockProviderConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigAmazonBedrockProviderConfigDict(TypedDict, total=False): + """""" + + direct: VariableOrOptional[ + ModelProviderServiceConfigAmazonBedrockProviderDirectConfigParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct form of Amazon Bedrock provider config. + + Authentication is one of two mutually exclusive modes, exactly one of which + must be supplied on Create: + - Access keys: set `aws_access_key`, leave `service_credential` unset. + - UC service credential: set `service_credential.name` to the AIP-122 + resource-name form `credentials/{name}`, leave `aws_access_key` unset. The + credential value lives in UC and is referenced by name, not held on this + message. + Setting more than one mode is rejected. + """ + + +ModelProviderServiceConfigAmazonBedrockProviderConfigParam = ( + ModelProviderServiceConfigAmazonBedrockProviderConfigDict + | ModelProviderServiceConfigAmazonBedrockProviderConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_direct_config.py new file mode 100644 index 00000000000..2ff430631d3 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_direct_config.py @@ -0,0 +1,120 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_aws_access_key import ( + ModelProviderServiceConfigAwsAccessKey, + ModelProviderServiceConfigAwsAccessKeyParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_service_credential import ( + ModelProviderServiceConfigServiceCredential, + ModelProviderServiceConfigServiceCredentialParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigAmazonBedrockProviderDirectConfig: + """ + Direct form of Amazon Bedrock provider config. + + Authentication is one of two mutually exclusive modes, exactly one of which + must be supplied on Create: + - Access keys: set `aws_access_key`, leave `service_credential` unset. + - UC service credential: set `service_credential.name` to the AIP-122 + resource-name form `credentials/{name}`, leave `aws_access_key` unset. The + credential value lives in UC and is referenced by name, not held on this + message. + Setting more than one mode is rejected. + """ + + aws_access_key: VariableOrOptional[ModelProviderServiceConfigAwsAccessKey] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] AWS access-key-pair auth. Mutually exclusive with `service_credential`. + """ + + region: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`). + Required on Create. + """ + + service_credential: VariableOrOptional[ + ModelProviderServiceConfigServiceCredential + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Reference to a UC service credential authorizing Bedrock requests. On + Create the caller supplies `service_credential.name` in the AIP-122 + resource-name form `credentials/{name}`. Required on Create when using + UC-service-credential auth; mutually exclusive with `aws_access_key`. The + credential is referenced by name; its value is not carried here. On read the + resolved `id` and `is_deleted` are also populated. Only supported on AWS-hosted + workspaces; Create requests from other clouds are rejected with + INVALID_PARAMETER_VALUE. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict( + self, + ) -> "ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict( + TypedDict, total=False +): + """""" + + aws_access_key: VariableOrOptional[ModelProviderServiceConfigAwsAccessKeyParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] AWS access-key-pair auth. Mutually exclusive with `service_credential`. + """ + + region: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`). + Required on Create. + """ + + service_credential: VariableOrOptional[ + ModelProviderServiceConfigServiceCredentialParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Reference to a UC service credential authorizing Bedrock requests. On + Create the caller supplies `service_credential.name` in the AIP-122 + resource-name form `credentials/{name}`. Required on Create when using + UC-service-credential auth; mutually exclusive with `aws_access_key`. The + credential is referenced by name; its value is not carried here. On read the + resolved `id` and `is_deleted` are also populated. Only supported on AWS-hosted + workspaces; Create requests from other clouds are rejected with + INVALID_PARAMETER_VALUE. + """ + + +ModelProviderServiceConfigAmazonBedrockProviderDirectConfigParam = ( + ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict + | ModelProviderServiceConfigAmazonBedrockProviderDirectConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_config.py new file mode 100644 index 00000000000..218c4470512 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_config.py @@ -0,0 +1,90 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_direct_config import ( + ModelProviderServiceConfigAnthropicProviderDirectConfig, + ModelProviderServiceConfigAnthropicProviderDirectConfigParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_relayed_config import ( + ModelProviderServiceConfigAnthropicProviderRelayedConfig, + ModelProviderServiceConfigAnthropicProviderRelayedConfigParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigAnthropicProviderConfig: + """ + Anthropic provider configuration. Exactly one of `direct` or `relayed` must + be set on Create; the two are mutually exclusive. + """ + + direct: VariableOrOptional[ + ModelProviderServiceConfigAnthropicProviderDirectConfig + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct (inline-credentials) form: caller supplies the API key in the + request body. Required on Create unless `relayed` is set. + """ + + relayed: VariableOrOptional[ + ModelProviderServiceConfigAnthropicProviderRelayedConfig + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Relayed (credential-less) form: no Anthropic credential is stored. Each + inference request instead carries the caller's own OAuth token, which the + platform forwards to Anthropic on outbound requests. Mutually exclusive + with `direct`; no `api_key` is required or persisted. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigAnthropicProviderConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigAnthropicProviderConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigAnthropicProviderConfigDict(TypedDict, total=False): + """""" + + direct: VariableOrOptional[ + ModelProviderServiceConfigAnthropicProviderDirectConfigParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct (inline-credentials) form: caller supplies the API key in the + request body. Required on Create unless `relayed` is set. + """ + + relayed: VariableOrOptional[ + ModelProviderServiceConfigAnthropicProviderRelayedConfigParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Relayed (credential-less) form: no Anthropic credential is stored. Each + inference request instead carries the caller's own OAuth token, which the + platform forwards to Anthropic on outbound requests. Mutually exclusive + with `direct`; no `api_key` is required or persisted. + """ + + +ModelProviderServiceConfigAnthropicProviderConfigParam = ( + ModelProviderServiceConfigAnthropicProviderConfigDict + | ModelProviderServiceConfigAnthropicProviderConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_direct_config.py new file mode 100644 index 00000000000..62815d57c17 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_direct_config.py @@ -0,0 +1,61 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import ( + ModelProviderServiceConfigProviderSecret, + ModelProviderServiceConfigProviderSecretParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigAnthropicProviderDirectConfig: + """ + Direct form of Anthropic provider config. + """ + + api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Anthropic API key. Required on Create. Sent as the `x-api-key` header on + outbound requests. Supplied as inline plaintext via + `ProviderSecret.plaintext`. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigAnthropicProviderDirectConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigAnthropicProviderDirectConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigAnthropicProviderDirectConfigDict( + TypedDict, total=False +): + """""" + + api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Anthropic API key. Required on Create. Sent as the `x-api-key` header on + outbound requests. Supplied as inline plaintext via + `ProviderSecret.plaintext`. + """ + + +ModelProviderServiceConfigAnthropicProviderDirectConfigParam = ( + ModelProviderServiceConfigAnthropicProviderDirectConfigDict + | ModelProviderServiceConfigAnthropicProviderDirectConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config.py new file mode 100644 index 00000000000..ed685584f4a --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config.py @@ -0,0 +1,69 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_relayed_config_anthropic_relayed_plan_type import ( + ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType, + ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanTypeParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigAnthropicProviderRelayedConfig: + """ + Relayed form of Anthropic provider config: no credential is stored. + Authentication is the caller's own OAuth token, forwarded to Anthropic on + outbound requests, so there is no persisted secret. Presence of this variant + is the signal that the provider service uses relayed auth; `plan_type` + further distinguishes which Anthropic subscription tier the token belongs to. + """ + + plan_type: VariableOrOptional[ + ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Which Anthropic subscription tier the relayed token belongs to. Optional; + when unset the MPS gets the full governance surface (see TEAM_ENTERPRISE). + Immutable after Create, so the tier cannot be flipped in place. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigAnthropicProviderRelayedConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigAnthropicProviderRelayedConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigAnthropicProviderRelayedConfigDict( + TypedDict, total=False +): + """""" + + plan_type: VariableOrOptional[ + ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanTypeParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Which Anthropic subscription tier the relayed token belongs to. Optional; + when unset the MPS gets the full governance surface (see TEAM_ENTERPRISE). + Immutable after Create, so the tier cannot be flipped in place. + """ + + +ModelProviderServiceConfigAnthropicProviderRelayedConfigParam = ( + ModelProviderServiceConfigAnthropicProviderRelayedConfigDict + | ModelProviderServiceConfigAnthropicProviderRelayedConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config_anthropic_relayed_plan_type.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config_anthropic_relayed_plan_type.py new file mode 100644 index 00000000000..d01ffd08cc1 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config_anthropic_relayed_plan_type.py @@ -0,0 +1,29 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from enum import Enum +from typing import Literal + + +class ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType( + Enum +): + """ + Which Anthropic subscription tier the relayed OAuth token belongs to. + Immutable after Create (switching tiers changes which governance controls + the platform enforces). Only MAX and TEAM_ENTERPRISE differ in the + governance surface the gateway can enforce, not in how the token is + relayed. + """ + + ANTHROPIC_RELAYED_PLAN_TYPE_MAX = "ANTHROPIC_RELAYED_PLAN_TYPE_MAX" + ANTHROPIC_RELAYED_PLAN_TYPE_TEAM_ENTERPRISE = ( + "ANTHROPIC_RELAYED_PLAN_TYPE_TEAM_ENTERPRISE" + ) + + +ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanTypeParam = ( + Literal[ + "ANTHROPIC_RELAYED_PLAN_TYPE_MAX", "ANTHROPIC_RELAYED_PLAN_TYPE_TEAM_ENTERPRISE" + ] + | ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_aws_access_key.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_aws_access_key.py new file mode 100644 index 00000000000..2ad6527db4e --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_aws_access_key.py @@ -0,0 +1,76 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import ( + ModelProviderServiceConfigProviderSecret, + ModelProviderServiceConfigProviderSecretParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigAwsAccessKey: + """ + AWS access-key-pair auth for Amazon Bedrock: a SigV4-signing key pair. + """ + + access_key_id: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] AWS access key ID. Required on Create when using access-key auth. Treated as + username-equivalent (not a secret value): round-trips on reads and is + scrubbed from audit logs. + """ + + secret_access_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = ( + None + ) + """ + :meta private: [EXPERIMENTAL] + + [Beta] AWS secret access key paired with `access_key_id`. Required on Create when + using access-key auth. Supplied as inline plaintext via + `ProviderSecret.plaintext`. + """ + + @classmethod + def from_dict(cls, value: "ModelProviderServiceConfigAwsAccessKeyDict") -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigAwsAccessKeyDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigAwsAccessKeyDict(TypedDict, total=False): + """""" + + access_key_id: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] AWS access key ID. Required on Create when using access-key auth. Treated as + username-equivalent (not a secret value): round-trips on reads and is + scrubbed from audit logs. + """ + + secret_access_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] AWS secret access key paired with `access_key_id`. Required on Create when + using access-key auth. Supplied as inline plaintext via + `ProviderSecret.plaintext`. + """ + + +ModelProviderServiceConfigAwsAccessKeyParam = ( + ModelProviderServiceConfigAwsAccessKeyDict | ModelProviderServiceConfigAwsAccessKey +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_config.py new file mode 100644 index 00000000000..3e9ae9100ba --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_config.py @@ -0,0 +1,81 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_azure_open_ai_provider_direct_config import ( + ModelProviderServiceConfigAzureOpenAiProviderDirectConfig, + ModelProviderServiceConfigAzureOpenAiProviderDirectConfigParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigAzureOpenAiProviderConfig: + """ + Azure OpenAI provider configuration. + """ + + direct: VariableOrOptional[ + ModelProviderServiceConfigAzureOpenAiProviderDirectConfig + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct form of Azure OpenAI provider config. Exactly one of three + mutually-exclusive auth modes must be supplied on Create: + - API key: set `api_key`, leave `entra_service_principal` and + `service_credential` unset. + - Entra ID (service principal): set `entra_service_principal`, leave + `api_key` and `service_credential` unset. + - UC service credential: set `service_credential.name` to the AIP-122 + resource-name form `credentials/{name}`, leave `api_key` and + `entra_service_principal` unset. The credential value lives in UC and is + referenced by name, not held on this message. Only supported on + Azure-hosted workspaces. + Setting more than one mode is rejected. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigAzureOpenAiProviderConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigAzureOpenAiProviderConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigAzureOpenAiProviderConfigDict(TypedDict, total=False): + """""" + + direct: VariableOrOptional[ + ModelProviderServiceConfigAzureOpenAiProviderDirectConfigParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct form of Azure OpenAI provider config. Exactly one of three + mutually-exclusive auth modes must be supplied on Create: + - API key: set `api_key`, leave `entra_service_principal` and + `service_credential` unset. + - Entra ID (service principal): set `entra_service_principal`, leave + `api_key` and `service_credential` unset. + - UC service credential: set `service_credential.name` to the AIP-122 + resource-name form `credentials/{name}`, leave `api_key` and + `entra_service_principal` unset. The credential value lives in UC and is + referenced by name, not held on this message. Only supported on + Azure-hosted workspaces. + Setting more than one mode is rejected. + """ + + +ModelProviderServiceConfigAzureOpenAiProviderConfigParam = ( + ModelProviderServiceConfigAzureOpenAiProviderConfigDict + | ModelProviderServiceConfigAzureOpenAiProviderConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_direct_config.py new file mode 100644 index 00000000000..e2f56b91507 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_direct_config.py @@ -0,0 +1,152 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_entra_service_principal import ( + ModelProviderServiceConfigEntraServicePrincipal, + ModelProviderServiceConfigEntraServicePrincipalParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import ( + ModelProviderServiceConfigProviderSecret, + ModelProviderServiceConfigProviderSecretParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_service_credential import ( + ModelProviderServiceConfigServiceCredential, + ModelProviderServiceConfigServiceCredentialParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigAzureOpenAiProviderDirectConfig: + """ + Direct form of Azure OpenAI provider config. Exactly one of three + mutually-exclusive auth modes must be supplied on Create: + - API key: set `api_key`, leave `entra_service_principal` and + `service_credential` unset. + - Entra ID (service principal): set `entra_service_principal`, leave + `api_key` and `service_credential` unset. + - UC service credential: set `service_credential.name` to the AIP-122 + resource-name form `credentials/{name}`, leave `api_key` and + `entra_service_principal` unset. The credential value lives in UC and is + referenced by name, not held on this message. Only supported on + Azure-hosted workspaces. + Setting more than one mode is rejected. + """ + + api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Azure OpenAI API key. Mutually exclusive with the Entra and + service-credential modes. Supplied as inline plaintext via + `ProviderSecret.plaintext`. + """ + + base_url: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Full Azure OpenAI endpoint base URL, e.g. + `https://myresource.openai.azure.com`. Required on Create. + """ + + entra_service_principal: VariableOrOptional[ + ModelProviderServiceConfigEntraServicePrincipal + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Entra ID (service principal) auth. Mutually exclusive with `api_key` and + `service_credential`. + """ + + service_credential: VariableOrOptional[ + ModelProviderServiceConfigServiceCredential + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Reference to a UC service credential authorizing Azure OpenAI requests. On + Create the caller supplies `service_credential.name` in the AIP-122 + resource-name form `credentials/{name}`. Required on Create when using + UC-service-credential auth; mutually exclusive with `api_key` and + `entra_service_principal`. The credential is + referenced by name; its value is not carried here. On read the resolved `id` + and `is_deleted` are also populated. Only supported on Azure-hosted + workspaces; Create requests from other clouds are rejected with + INVALID_PARAMETER_VALUE. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict( + self, + ) -> "ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict( + TypedDict, total=False +): + """""" + + api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Azure OpenAI API key. Mutually exclusive with the Entra and + service-credential modes. Supplied as inline plaintext via + `ProviderSecret.plaintext`. + """ + + base_url: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Full Azure OpenAI endpoint base URL, e.g. + `https://myresource.openai.azure.com`. Required on Create. + """ + + entra_service_principal: VariableOrOptional[ + ModelProviderServiceConfigEntraServicePrincipalParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Entra ID (service principal) auth. Mutually exclusive with `api_key` and + `service_credential`. + """ + + service_credential: VariableOrOptional[ + ModelProviderServiceConfigServiceCredentialParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Reference to a UC service credential authorizing Azure OpenAI requests. On + Create the caller supplies `service_credential.name` in the AIP-122 + resource-name form `credentials/{name}`. Required on Create when using + UC-service-credential auth; mutually exclusive with `api_key` and + `entra_service_principal`. The credential is + referenced by name; its value is not carried here. On read the resolved `id` + and `is_deleted` are also populated. Only supported on Azure-hosted + workspaces; Create requests from other clouds are rejected with + INVALID_PARAMETER_VALUE. + """ + + +ModelProviderServiceConfigAzureOpenAiProviderDirectConfigParam = ( + ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict + | ModelProviderServiceConfigAzureOpenAiProviderDirectConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_config.py new file mode 100644 index 00000000000..1b55ddefd2a --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_config.py @@ -0,0 +1,75 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_custom_provider_direct_config import ( + ModelProviderServiceConfigCustomProviderDirectConfig, + ModelProviderServiceConfigCustomProviderDirectConfigParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigCustomProviderConfig: + """ + Custom provider configuration: arbitrary HTTP endpoint with bearer-token auth. + """ + + direct: VariableOrOptional[ModelProviderServiceConfigCustomProviderDirectConfig] = ( + None + ) + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct form of custom provider config. + + Authentication is one of two mutually exclusive modes, exactly one of which + must be supplied on Create: + - Bearer: set `api_key`, leave `header_auth` unset. The secret is + forwarded as `Authorization: Bearer `. + - Header: set `header_auth`, leave `api_key` unset. The secret is + forwarded as `: `. + Setting both modes or neither mode is rejected. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigCustomProviderConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigCustomProviderConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigCustomProviderConfigDict(TypedDict, total=False): + """""" + + direct: VariableOrOptional[ + ModelProviderServiceConfigCustomProviderDirectConfigParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct form of custom provider config. + + Authentication is one of two mutually exclusive modes, exactly one of which + must be supplied on Create: + - Bearer: set `api_key`, leave `header_auth` unset. The secret is + forwarded as `Authorization: Bearer `. + - Header: set `header_auth`, leave `api_key` unset. The secret is + forwarded as `: `. + Setting both modes or neither mode is rejected. + """ + + +ModelProviderServiceConfigCustomProviderConfigParam = ( + ModelProviderServiceConfigCustomProviderConfigDict + | ModelProviderServiceConfigCustomProviderConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_direct_config.py new file mode 100644 index 00000000000..bd1289bddf8 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_direct_config.py @@ -0,0 +1,83 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import ( + ModelProviderServiceConfigProviderSecret, + ModelProviderServiceConfigProviderSecretParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigCustomProviderDirectConfig: + """ + Direct form of custom provider config. + + Authentication is one of two mutually exclusive modes, exactly one of which + must be supplied on Create: + - Bearer: set `api_key`, leave `header_auth` unset. The secret is + forwarded as `Authorization: Bearer `. + - Header: set `header_auth`, leave `api_key` unset. The secret is + forwarded as `: `. + Setting both modes or neither mode is rejected. + """ + + api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Bearer token forwarded as the `Authorization: Bearer ...` header on + outbound requests. Supplied as inline plaintext via + `ProviderSecret.plaintext`. Set this for bearer-token auth. + """ + + base_url: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Endpoint URL of the OpenAI-compatible service (e.g., + `https://api.example.com/v1`). Required on Create. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigCustomProviderDirectConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigCustomProviderDirectConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigCustomProviderDirectConfigDict(TypedDict, total=False): + """""" + + api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Bearer token forwarded as the `Authorization: Bearer ...` header on + outbound requests. Supplied as inline plaintext via + `ProviderSecret.plaintext`. Set this for bearer-token auth. + """ + + base_url: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Endpoint URL of the OpenAI-compatible service (e.g., + `https://api.example.com/v1`). Required on Create. + """ + + +ModelProviderServiceConfigCustomProviderDirectConfigParam = ( + ModelProviderServiceConfigCustomProviderDirectConfigDict + | ModelProviderServiceConfigCustomProviderDirectConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_entra_service_principal.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_entra_service_principal.py new file mode 100644 index 00000000000..5e4b2ace0a1 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_entra_service_principal.py @@ -0,0 +1,89 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import ( + ModelProviderServiceConfigProviderSecret, + ModelProviderServiceConfigProviderSecretParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigEntraServicePrincipal: + """ + Entra ID (Azure AD) service-principal auth: AI Gateway exchanges the + `tenant_id` + `client_id` identify the service principal, and the `credential` + oneof proves that identity, exchanged for an Entra bearer token on outbound + requests via the OAuth2 client-credentials grant. Shared by the Azure OpenAI + and Microsoft Foundry provider configs. + """ + + client_id: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Entra ID client (application) ID. Required on Create. + """ + + client_secret: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Entra ID client secret. Supplied as inline plaintext via + `ProviderSecret.plaintext`. + """ + + tenant_id: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Entra ID (Azure AD) tenant ID. Required on Create. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigEntraServicePrincipalDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigEntraServicePrincipalDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigEntraServicePrincipalDict(TypedDict, total=False): + """""" + + client_id: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Entra ID client (application) ID. Required on Create. + """ + + client_secret: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Entra ID client secret. Supplied as inline plaintext via + `ProviderSecret.plaintext`. + """ + + tenant_id: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Entra ID (Azure AD) tenant ID. Required on Create. + """ + + +ModelProviderServiceConfigEntraServicePrincipalParam = ( + ModelProviderServiceConfigEntraServicePrincipalDict + | ModelProviderServiceConfigEntraServicePrincipal +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_external_model_provider_type.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_external_model_provider_type.py new file mode 100644 index 00000000000..05d65fd793c --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_external_model_provider_type.py @@ -0,0 +1,40 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from enum import Enum +from typing import Literal + + +class ModelProviderServiceConfigExternalModelProviderType(Enum): + """ + External LLM provider for an EXTERNAL_FOUNDATION_MODEL destination. + """ + + EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI = "EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI" + EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI = ( + "EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI" + ) + EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC = "EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC" + EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK = ( + "EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK" + ) + EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM = "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM" + EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY = ( + "EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY" + ) + EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE = ( + "EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE" + ) + + +ModelProviderServiceConfigExternalModelProviderTypeParam = ( + Literal[ + "EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI", + "EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI", + "EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC", + "EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK", + "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM", + "EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY", + "EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE", + ] + | ModelProviderServiceConfigExternalModelProviderType +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_config.py new file mode 100644 index 00000000000..a9c8a1aab39 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_config.py @@ -0,0 +1,71 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_gemini_enterprise_provider_direct_config import ( + ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig, + ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigGeminiEnterpriseProviderConfig: + """ + Gemini Enterprise provider configuration. + """ + + direct: VariableOrOptional[ + ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct form of Gemini Enterprise provider config. + + Authentication is one of two mutually exclusive modes; exactly one must be + supplied on Create: + - API key: set `api_key`, leave `service_credential` unset. + - UC service credential: set `service_credential`, leave `api_key` unset. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigGeminiEnterpriseProviderConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigGeminiEnterpriseProviderConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigGeminiEnterpriseProviderConfigDict( + TypedDict, total=False +): + """""" + + direct: VariableOrOptional[ + ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct form of Gemini Enterprise provider config. + + Authentication is one of two mutually exclusive modes; exactly one must be + supplied on Create: + - API key: set `api_key`, leave `service_credential` unset. + - UC service credential: set `service_credential`, leave `api_key` unset. + """ + + +ModelProviderServiceConfigGeminiEnterpriseProviderConfigParam = ( + ModelProviderServiceConfigGeminiEnterpriseProviderConfigDict + | ModelProviderServiceConfigGeminiEnterpriseProviderConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_direct_config.py new file mode 100644 index 00000000000..7d1a5d9b9f7 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_direct_config.py @@ -0,0 +1,98 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import ( + ModelProviderServiceConfigProviderSecret, + ModelProviderServiceConfigProviderSecretParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig: + """ + Direct form of Gemini Enterprise provider config. + + Authentication is one of two mutually exclusive modes; exactly one must be + supplied on Create: + - API key: set `api_key`, leave `service_credential` unset. + - UC service credential: set `service_credential`, leave `api_key` unset. + """ + + api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Google Gemini Enterprise API key. Required on Create when using API-key + auth; mutually exclusive with `service_credential`. Supplied as inline + plaintext via `ProviderSecret.plaintext`. + """ + + project_id: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] GCP project ID hosting the Gemini Enterprise endpoint. Required on Create. + """ + + region: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`). + Required on Create. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict( + self, + ) -> "ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigDict( + TypedDict, total=False +): + """""" + + api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Google Gemini Enterprise API key. Required on Create when using API-key + auth; mutually exclusive with `service_credential`. Supplied as inline + plaintext via `ProviderSecret.plaintext`. + """ + + project_id: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] GCP project ID hosting the Gemini Enterprise endpoint. Required on Create. + """ + + region: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`). + Required on Create. + """ + + +ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigParam = ( + ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigDict + | ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_config.py new file mode 100644 index 00000000000..7f91bf9ac35 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_config.py @@ -0,0 +1,91 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_microsoft_foundry_provider_direct_config import ( + ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig, + ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigMicrosoftFoundryProviderConfig: + """ + Microsoft Foundry provider configuration. + """ + + direct: VariableOrOptional[ + ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct form of Microsoft Foundry provider config. + + Authentication is one of three mutually exclusive modes, exactly one of which + must be supplied on Create: + - API key: set `api_key`, leave `entra_service_principal` and + `service_credential` unset. + - Entra ID (service principal): set `entra_service_principal`, leave + `api_key` and `service_credential` unset. AI Gateway exchanges these for + an Entra bearer token on outbound requests via the OAuth2 + client-credentials grant. + - UC service credential: set `service_credential.name` to the AIP-122 + resource-name form `credentials/{name}`, leave `api_key` and + `entra_service_principal` unset. The credential value lives in UC and is + referenced by name, not held on this message. Only supported on + Azure-hosted workspaces. + Setting more than one mode is rejected. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigMicrosoftFoundryProviderConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigMicrosoftFoundryProviderConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigMicrosoftFoundryProviderConfigDict( + TypedDict, total=False +): + """""" + + direct: VariableOrOptional[ + ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct form of Microsoft Foundry provider config. + + Authentication is one of three mutually exclusive modes, exactly one of which + must be supplied on Create: + - API key: set `api_key`, leave `entra_service_principal` and + `service_credential` unset. + - Entra ID (service principal): set `entra_service_principal`, leave + `api_key` and `service_credential` unset. AI Gateway exchanges these for + an Entra bearer token on outbound requests via the OAuth2 + client-credentials grant. + - UC service credential: set `service_credential.name` to the AIP-122 + resource-name form `credentials/{name}`, leave `api_key` and + `entra_service_principal` unset. The credential value lives in UC and is + referenced by name, not held on this message. Only supported on + Azure-hosted workspaces. + Setting more than one mode is rejected. + """ + + +ModelProviderServiceConfigMicrosoftFoundryProviderConfigParam = ( + ModelProviderServiceConfigMicrosoftFoundryProviderConfigDict + | ModelProviderServiceConfigMicrosoftFoundryProviderConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_direct_config.py new file mode 100644 index 00000000000..a4627bafd23 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_direct_config.py @@ -0,0 +1,154 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_entra_service_principal import ( + ModelProviderServiceConfigEntraServicePrincipal, + ModelProviderServiceConfigEntraServicePrincipalParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import ( + ModelProviderServiceConfigProviderSecret, + ModelProviderServiceConfigProviderSecretParam, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config_service_credential import ( + ModelProviderServiceConfigServiceCredential, + ModelProviderServiceConfigServiceCredentialParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig: + """ + Direct form of Microsoft Foundry provider config. + + Authentication is one of three mutually exclusive modes, exactly one of which + must be supplied on Create: + - API key: set `api_key`, leave `entra_service_principal` and + `service_credential` unset. + - Entra ID (service principal): set `entra_service_principal`, leave + `api_key` and `service_credential` unset. AI Gateway exchanges these for + an Entra bearer token on outbound requests via the OAuth2 + client-credentials grant. + - UC service credential: set `service_credential.name` to the AIP-122 + resource-name form `credentials/{name}`, leave `api_key` and + `entra_service_principal` unset. The credential value lives in UC and is + referenced by name, not held on this message. Only supported on + Azure-hosted workspaces. + Setting more than one mode is rejected. + """ + + api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Microsoft AI Foundry API key. Mutually exclusive with the Entra and + service-credential modes. Supplied as inline plaintext via + `ProviderSecret.plaintext`. + """ + + base_url: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Microsoft AI Foundry endpoint URL. Required on Create. + """ + + entra_service_principal: VariableOrOptional[ + ModelProviderServiceConfigEntraServicePrincipal + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Entra ID (service principal) auth. Mutually exclusive with `api_key` and + `service_credential`. + """ + + service_credential: VariableOrOptional[ + ModelProviderServiceConfigServiceCredential + ] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Reference to a UC service credential authorizing Microsoft Foundry requests. + On Create the caller supplies `service_credential.name` in the AIP-122 + resource-name form `credentials/{name}`. Required on Create when using + UC-service-credential auth; mutually exclusive with `api_key` and + `entra_service_principal`. The credential is + referenced by name; its value is not carried here. On read the resolved `id` + and `is_deleted` are also populated. Only supported on Azure-hosted + workspaces; Create requests from other clouds are rejected with + INVALID_PARAMETER_VALUE. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict( + self, + ) -> "ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict( + TypedDict, total=False +): + """""" + + api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Microsoft AI Foundry API key. Mutually exclusive with the Entra and + service-credential modes. Supplied as inline plaintext via + `ProviderSecret.plaintext`. + """ + + base_url: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Microsoft AI Foundry endpoint URL. Required on Create. + """ + + entra_service_principal: VariableOrOptional[ + ModelProviderServiceConfigEntraServicePrincipalParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Entra ID (service principal) auth. Mutually exclusive with `api_key` and + `service_credential`. + """ + + service_credential: VariableOrOptional[ + ModelProviderServiceConfigServiceCredentialParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Reference to a UC service credential authorizing Microsoft Foundry requests. + On Create the caller supplies `service_credential.name` in the AIP-122 + resource-name form `credentials/{name}`. Required on Create when using + UC-service-credential auth; mutually exclusive with `api_key` and + `entra_service_principal`. The credential is + referenced by name; its value is not carried here. On read the resolved `id` + and `is_deleted` are also populated. Only supported on Azure-hosted + workspaces; Create requests from other clouds are rejected with + INVALID_PARAMETER_VALUE. + """ + + +ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigParam = ( + ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict + | ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_model_target_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_model_target_config.py new file mode 100644 index 00000000000..d2538a33196 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_model_target_config.py @@ -0,0 +1,79 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass, field +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOr, VariableOrList + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigModelTargetConfig: + """ + Model target configuration for an external model destination. + """ + + model: VariableOr[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Provider-side model identifier (e.g. "gpt-5", "claude-opus-4-7"). This is + a string on the LLM provider's side, not a UC entity. The UC governance + hook for external destinations is the ModelProviderService referenced by + `ExternalModelConfig.model_provider_service`, not the model itself. + """ + + native_api_types: VariableOrList[str] = field(default_factory=list) + """ + :meta private: [EXPERIMENTAL] + + [Beta] Provider-native API types the model supports (e.g. + "openai/v1/chat/completions"). Used by the platform for request/response + translation from the unified API type. At most 64 entries of at most 256 + characters each; the list is persisted into the destination binding's + bounded storage envelope. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigModelTargetConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigModelTargetConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigModelTargetConfigDict(TypedDict, total=False): + """""" + + model: VariableOr[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Provider-side model identifier (e.g. "gpt-5", "claude-opus-4-7"). This is + a string on the LLM provider's side, not a UC entity. The UC governance + hook for external destinations is the ModelProviderService referenced by + `ExternalModelConfig.model_provider_service`, not the model itself. + """ + + native_api_types: VariableOrList[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Provider-native API types the model supports (e.g. + "openai/v1/chat/completions"). Used by the platform for request/response + translation from the unified API type. At most 64 entries of at most 256 + characters each; the list is persisted into the destination binding's + bounded storage envelope. + """ + + +ModelProviderServiceConfigModelTargetConfigParam = ( + ModelProviderServiceConfigModelTargetConfigDict + | ModelProviderServiceConfigModelTargetConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_config.py new file mode 100644 index 00000000000..29a88e526b7 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_config.py @@ -0,0 +1,59 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_open_ai_provider_direct_config import ( + ModelProviderServiceConfigOpenAiProviderDirectConfig, + ModelProviderServiceConfigOpenAiProviderDirectConfigParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigOpenAiProviderConfig: + """ + OpenAI provider configuration. + """ + + direct: VariableOrOptional[ModelProviderServiceConfigOpenAiProviderDirectConfig] = ( + None + ) + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct (inline-credentials) form of the OpenAI provider config. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigOpenAiProviderConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigOpenAiProviderConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigOpenAiProviderConfigDict(TypedDict, total=False): + """""" + + direct: VariableOrOptional[ + ModelProviderServiceConfigOpenAiProviderDirectConfigParam + ] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Direct (inline-credentials) form of the OpenAI provider config. + """ + + +ModelProviderServiceConfigOpenAiProviderConfigParam = ( + ModelProviderServiceConfigOpenAiProviderConfigDict + | ModelProviderServiceConfigOpenAiProviderConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_direct_config.py new file mode 100644 index 00000000000..5b88a5fd908 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_direct_config.py @@ -0,0 +1,89 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional +from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import ( + ModelProviderServiceConfigProviderSecret, + ModelProviderServiceConfigProviderSecretParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigOpenAiProviderDirectConfig: + """ + Direct (inline-credentials) form of the OpenAI provider config. + """ + + api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] OpenAI API key. Required on Create. Supplied as inline plaintext via + `ProviderSecret.plaintext`. + """ + + base_url: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for + OpenAI-API-compatible third-party endpoints or in-network proxies. + """ + + organization: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Optional OpenAI organization ID. When set, the platform forwards it as + the `OpenAI-Organization` header. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigOpenAiProviderDirectConfigDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigOpenAiProviderDirectConfigDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigOpenAiProviderDirectConfigDict(TypedDict, total=False): + """""" + + api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] OpenAI API key. Required on Create. Supplied as inline plaintext via + `ProviderSecret.plaintext`. + """ + + base_url: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for + OpenAI-API-compatible third-party endpoints or in-network proxies. + """ + + organization: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Optional OpenAI organization ID. When set, the platform forwards it as + the `OpenAI-Organization` header. + """ + + +ModelProviderServiceConfigOpenAiProviderDirectConfigParam = ( + ModelProviderServiceConfigOpenAiProviderDirectConfigDict + | ModelProviderServiceConfigOpenAiProviderDirectConfig +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_secret.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_secret.py new file mode 100644 index 00000000000..b903e2351d1 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_secret.py @@ -0,0 +1,56 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOrOptional + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigProviderSecret: + """ + A secret value supplied as part of an inline provider config. The caller + supplies the value as inline `plaintext` on writes; the platform stores it + encrypted. The `plaintext` field is `INPUT_ONLY` and never round-trips on + reads. + """ + + plaintext: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Inline plaintext credential. INPUT_ONLY: the value never round-trips on + reads. Get and List responses omit `plaintext`; the field's presence in + the read shape only indicates that a secret is configured. + """ + + @classmethod + def from_dict(cls, value: "ModelProviderServiceConfigProviderSecretDict") -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigProviderSecretDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigProviderSecretDict(TypedDict, total=False): + """""" + + plaintext: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Inline plaintext credential. INPUT_ONLY: the value never round-trips on + reads. Get and List responses omit `plaintext`; the field's presence in + the read shape only indicates that a secret is configured. + """ + + +ModelProviderServiceConfigProviderSecretParam = ( + ModelProviderServiceConfigProviderSecretDict + | ModelProviderServiceConfigProviderSecret +) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_service_credential.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_service_credential.py new file mode 100644 index 00000000000..543c9efed49 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_service_credential.py @@ -0,0 +1,59 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOr + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class ModelProviderServiceConfigServiceCredential: + """ + ---- Provider configuration (nested; see the `provider` oneof below) ---- + The customer-owned UC service credential a ModelProviderService uses to + authenticate to its provider, referenced by name. + """ + + name: VariableOr[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Resource name of the bound UC service credential, in the AIP-122 form + `credentials/{name}` (a metastore-level single-part credential name). On + create the caller supplies the name here. On read it reflects the + credential's current name at read time. + """ + + @classmethod + def from_dict( + cls, value: "ModelProviderServiceConfigServiceCredentialDict" + ) -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "ModelProviderServiceConfigServiceCredentialDict": + return _transform_to_json_value(self) # type:ignore + + +class ModelProviderServiceConfigServiceCredentialDict(TypedDict, total=False): + """""" + + name: VariableOr[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Resource name of the bound UC service credential, in the AIP-122 form + `credentials/{name}` (a metastore-level single-part credential name). On + create the caller supplies the name here. On read it reflects the + credential's current name at read time. + """ + + +ModelProviderServiceConfigServiceCredentialParam = ( + ModelProviderServiceConfigServiceCredentialDict + | ModelProviderServiceConfigServiceCredential +) diff --git a/python/databricks/bundles/model_provider_services/_models/rate_limit.py b/python/databricks/bundles/model_provider_services/_models/rate_limit.py new file mode 100644 index 00000000000..1161810fc32 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/rate_limit.py @@ -0,0 +1,154 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from dataclasses import dataclass +from typing import TYPE_CHECKING, TypedDict + +from databricks.bundles.core._transform import _transform +from databricks.bundles.core._transform_to_json import _transform_to_json_value +from databricks.bundles.core._variable import VariableOr, VariableOrOptional +from databricks.bundles.model_provider_services._models.rate_limit_rate_limit_key import ( + RateLimitRateLimitKey, + RateLimitRateLimitKeyParam, +) +from databricks.bundles.model_provider_services._models.rate_limit_rate_limit_renewal_period import ( + RateLimitRateLimitRenewalPeriod, + RateLimitRateLimitRenewalPeriodParam, +) + +if TYPE_CHECKING: + from typing_extensions import Self + + +@dataclass(kw_only=True) +class RateLimit: + """ + A rate limit applied to service requests. Leave `requests` or `tokens` + unset to impose no limit on that dimension; set a value to cap that dimension + within the renewal period. + """ + + key: VariableOr[RateLimitRateLimitKey] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Scope key. Determines whether `principal` is required. + """ + + renewal_period: VariableOr[RateLimitRateLimitRenewalPeriod] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Renewal period. + """ + + principal: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Principal this limit applies to: user email, group name, or service + principal application ID. Required unless `key` is + `RATE_LIMIT_KEY_SERVICE`, `RATE_LIMIT_KEY_USER_DEFAULT`, or + `RATE_LIMIT_KEY_REQUEST_TAG` (which must not set a principal). + """ + + request_tag_key: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Request tag key this limit applies to. Required when `key` is + `RATE_LIMIT_KEY_REQUEST_TAG`, forbidden otherwise. + """ + + request_tag_value: VariableOrOptional[str] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Request tag value this limit applies to. Only valid when `key` is + `RATE_LIMIT_KEY_REQUEST_TAG`. Leave unset to apply the limit to every + value of `request_tag_key` (an any-value default); a set value is a + specific override for that value. + """ + + requests: VariableOrOptional[int] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Max requests allowed within a renewal period. Leave unset for no request limit. + """ + + tokens: VariableOrOptional[int] = None + """ + :meta private: [EXPERIMENTAL] + + [Beta] Max tokens allowed within a renewal period. Leave unset for no token limit. + """ + + @classmethod + def from_dict(cls, value: "RateLimitDict") -> "Self": + return _transform(cls, value) + + def as_dict(self) -> "RateLimitDict": + return _transform_to_json_value(self) # type:ignore + + +class RateLimitDict(TypedDict, total=False): + """""" + + key: VariableOr[RateLimitRateLimitKeyParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Scope key. Determines whether `principal` is required. + """ + + renewal_period: VariableOr[RateLimitRateLimitRenewalPeriodParam] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Renewal period. + """ + + principal: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Principal this limit applies to: user email, group name, or service + principal application ID. Required unless `key` is + `RATE_LIMIT_KEY_SERVICE`, `RATE_LIMIT_KEY_USER_DEFAULT`, or + `RATE_LIMIT_KEY_REQUEST_TAG` (which must not set a principal). + """ + + request_tag_key: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Request tag key this limit applies to. Required when `key` is + `RATE_LIMIT_KEY_REQUEST_TAG`, forbidden otherwise. + """ + + request_tag_value: VariableOrOptional[str] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Request tag value this limit applies to. Only valid when `key` is + `RATE_LIMIT_KEY_REQUEST_TAG`. Leave unset to apply the limit to every + value of `request_tag_key` (an any-value default); a set value is a + specific override for that value. + """ + + requests: VariableOrOptional[int] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Max requests allowed within a renewal period. Leave unset for no request limit. + """ + + tokens: VariableOrOptional[int] + """ + :meta private: [EXPERIMENTAL] + + [Beta] Max tokens allowed within a renewal period. Leave unset for no token limit. + """ + + +RateLimitParam = RateLimitDict | RateLimit diff --git a/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_key.py b/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_key.py new file mode 100644 index 00000000000..0e4c11862a8 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_key.py @@ -0,0 +1,30 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from enum import Enum +from typing import Literal + + +class RateLimitRateLimitKey(Enum): + """ + Scope key for a rate limit. + """ + + RATE_LIMIT_KEY_USER = "RATE_LIMIT_KEY_USER" + RATE_LIMIT_KEY_USER_GROUP = "RATE_LIMIT_KEY_USER_GROUP" + RATE_LIMIT_KEY_SERVICE_PRINCIPAL = "RATE_LIMIT_KEY_SERVICE_PRINCIPAL" + RATE_LIMIT_KEY_SERVICE = "RATE_LIMIT_KEY_SERVICE" + RATE_LIMIT_KEY_USER_DEFAULT = "RATE_LIMIT_KEY_USER_DEFAULT" + RATE_LIMIT_KEY_REQUEST_TAG = "RATE_LIMIT_KEY_REQUEST_TAG" + + +RateLimitRateLimitKeyParam = ( + Literal[ + "RATE_LIMIT_KEY_USER", + "RATE_LIMIT_KEY_USER_GROUP", + "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", + "RATE_LIMIT_KEY_SERVICE", + "RATE_LIMIT_KEY_USER_DEFAULT", + "RATE_LIMIT_KEY_REQUEST_TAG", + ] + | RateLimitRateLimitKey +) diff --git a/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_renewal_period.py b/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_renewal_period.py new file mode 100644 index 00000000000..58636c784c0 --- /dev/null +++ b/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_renewal_period.py @@ -0,0 +1,19 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from enum import Enum +from typing import Literal + + +class RateLimitRateLimitRenewalPeriod(Enum): + """ + Renewal period for a rate limit. + """ + + RATE_LIMIT_RENEWAL_PERIOD_MINUTE = "RATE_LIMIT_RENEWAL_PERIOD_MINUTE" + RATE_LIMIT_RENEWAL_PERIOD_HOUR = "RATE_LIMIT_RENEWAL_PERIOD_HOUR" + + +RateLimitRateLimitRenewalPeriodParam = ( + Literal["RATE_LIMIT_RENEWAL_PERIOD_MINUTE", "RATE_LIMIT_RENEWAL_PERIOD_HOUR"] + | RateLimitRateLimitRenewalPeriod +) diff --git a/python/databricks_tests/core/_generated/__init__.py b/python/databricks_tests/core/_generated/__init__.py index 4ab30185d16..486f70d1a64 100644 --- a/python/databricks_tests/core/_generated/__init__.py +++ b/python/databricks_tests/core/_generated/__init__.py @@ -13,6 +13,7 @@ job_runs, jobs, mcp_services, + model_provider_services, model_services, model_serving_endpoints, models, @@ -45,6 +46,7 @@ job_runs._test_case(), jobs._test_case(), mcp_services._test_case(), + model_provider_services._test_case(), model_services._test_case(), model_serving_endpoints._test_case(), models._test_case(), diff --git a/python/databricks_tests/core/_generated/model_provider_services.py b/python/databricks_tests/core/_generated/model_provider_services.py new file mode 100644 index 00000000000..f91592daebb --- /dev/null +++ b/python/databricks_tests/core/_generated/model_provider_services.py @@ -0,0 +1,34 @@ +# Code generated by pydabs-codegen. DO NOT EDIT. + +from databricks.bundles.core import Resources, model_provider_service_mutator +from databricks.bundles.core._generated.model_provider_services import _resource_type +from databricks.bundles.model_provider_services._models.lifecycle import Lifecycle +from databricks.bundles.model_provider_services._models.model_provider_service import ( + ModelProviderService, +) +from databricks.bundles.model_provider_services._models.model_provider_service_config import ( + ModelProviderServiceConfig, +) +from databricks_tests.core._resource_test_case import ResourceTestCase + + +def _test_case(): + return ( + ResourceTestCase( + add_resource=Resources.add_model_provider_service, + dict_example={ + "config": {}, + "lifecycle": {}, + "model_provider_service_id": "model_provider_service_id", + "parent": "parent", + }, + dataclass_example=ModelProviderService( + config=ModelProviderServiceConfig(), + lifecycle=Lifecycle(), + model_provider_service_id="model_provider_service_id", + parent="parent", + ), + mutator=model_provider_service_mutator, + ), + _resource_type(), + ) diff --git a/python/databricks_tests/core/public_api.txt b/python/databricks_tests/core/public_api.txt index 5e6a64a1dcd..0c259ce5dfb 100644 --- a/python/databricks_tests/core/public_api.txt +++ b/python/databricks_tests/core/public_api.txt @@ -30,6 +30,7 @@ __all__ = [ mcp_service_mutator, mlflow_experiment_mutator, mlflow_model_mutator, + model_provider_service_mutator, model_service_mutator, model_serving_endpoint_mutator, pipeline_mutator, @@ -103,6 +104,7 @@ class Resources: def add_mcp_service(self, resource_name: str, mcp_service: McpServiceParam, *, location: Union[Location, None] = None) -> None def add_mlflow_experiment(self, resource_name: str, mlflow_experiment: MlflowExperimentParam, *, location: Union[Location, None] = None) -> None def add_mlflow_model(self, resource_name: str, mlflow_model: MlflowModelParam, *, location: Union[Location, None] = None) -> None + def add_model_provider_service(self, resource_name: str, model_provider_service: ModelProviderServiceParam, *, location: Union[Location, None] = None) -> None def add_model_service(self, resource_name: str, model_service: ModelServiceParam, *, location: Union[Location, None] = None) -> None def add_model_serving_endpoint(self, resource_name: str, model_serving_endpoint: ModelServingEndpointParam, *, location: Union[Location, None] = None) -> None def add_pipeline(self, resource_name: str, pipeline: PipelineParam, *, location: Union[Location, None] = None) -> None @@ -132,6 +134,7 @@ class Resources: @property job_runs -> dict[str, JobRun] @property jobs -> dict[str, Job] @property mcp_services -> dict[str, McpService] + @property model_provider_services -> dict[str, ModelProviderService] @property model_services -> dict[str, ModelService] @property model_serving_endpoints -> dict[str, ModelServingEndpoint] @property models -> dict[str, MlflowModel] @@ -225,6 +228,10 @@ def mlflow_experiment_mutator(function: Callable) -> ResourceMutator[MlflowExper @overload def mlflow_model_mutator(function: Callable[[MlflowModel], MlflowModel]) -> ResourceMutator[MlflowModel] def mlflow_model_mutator(function: Callable) -> ResourceMutator[MlflowModel] +@overload def model_provider_service_mutator(function: Callable[[Bundle, ModelProviderService], ModelProviderService]) -> ResourceMutator[ModelProviderService] +@overload def model_provider_service_mutator(function: Callable[[ModelProviderService], ModelProviderService]) -> ResourceMutator[ModelProviderService] +def model_provider_service_mutator(function: Callable) -> ResourceMutator[ModelProviderService] + @overload def model_service_mutator(function: Callable[[Bundle, ModelService], ModelService]) -> ResourceMutator[ModelService] @overload def model_service_mutator(function: Callable[[ModelService], ModelService]) -> ResourceMutator[ModelService] def model_service_mutator(function: Callable) -> ResourceMutator[ModelService] @@ -297,6 +304,7 @@ singular_name=job_run plural_name=job_runs resource_type=JobRun singular_name=mcp_service plural_name=mcp_services resource_type=McpService singular_name=mlflow_experiment plural_name=experiments resource_type=MlflowExperiment singular_name=mlflow_model plural_name=models resource_type=MlflowModel +singular_name=model_provider_service plural_name=model_provider_services resource_type=ModelProviderService singular_name=model_service plural_name=model_services resource_type=ModelService singular_name=model_serving_endpoint plural_name=model_serving_endpoints resource_type=ModelServingEndpoint singular_name=pipeline plural_name=pipelines resource_type=Pipeline From 76478c8f4f9116ef671d9ccae7663cd1d5e31a2c Mon Sep 17 00:00:00 2001 From: Alex Khakhlyuk Date: Mon, 14 Sep 2026 12:50:37 +0000 Subject: [PATCH 2/5] Auto-generate output_only field behaviour for model_provider_services Follow-up mirroring #6654 (model_services) and the mcp_services cleanup, now that #6618 enabled generating field behaviors from the response type. Added catalog.ModelProviderService to apitypes.yml, removed the hand-written recreate_on_changes (config.provider_type) and ignore_remote_changes (inference_table + write-only provider credentials) from resources.yml, and regenerated resources.generated.yml. The generator now derives all of these from the OpenAPI schema (and additionally picks up config.anthropic.relayed. plan_type as immutable); no suppression is lost. Co-authored-by: Isaac --- bundle/direct/dresources/apitypes.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/bundle/direct/dresources/apitypes.yml b/bundle/direct/dresources/apitypes.yml index a7257a525ae..ba16fd72c6a 100644 --- a/bundle/direct/dresources/apitypes.yml +++ b/bundle/direct/dresources/apitypes.yml @@ -13,6 +13,8 @@ genie_spaces: dashboards.GenieSpace mcp_services: catalog.McpService +model_provider_services: catalog.ModelProviderService + model_services: catalog.ModelService postgres_branches: postgres.BranchSpec From 33cfb4db45ea5a91e5c14ce9f0adfd3f2adf404b Mon Sep 17 00:00:00 2001 From: Alex Khakhlyuk Date: Mon, 14 Sep 2026 16:59:27 +0000 Subject: [PATCH 3/5] Rebase onto main: adopt databricks-sdk-go v0.178 (drop owner + request_tag) Main upgraded databricks-sdk-go v0.177 -> v0.178, the GA-sync SDK that dropped `owner` (effective_owner only now), the request_tag rate-limit feature, and the anthropic relayed plan_type from the AI Gateway securable types. Adapted the model_provider_service resource to v0.178: removed the stale Owner field from modelProviderServiceBody, and regenerated schema/validation/refschema/pydabs. RATE_LIMIT_KEY_REQUEST_TAG is now absent from model_provider_services (and model_services / mcp_services), matching the v0.178 spec. Co-authored-by: Isaac --- acceptance/bundle/refschema/out.fields.txt | 4 - .../dresources/model_provider_service.go | 1 - .../validation/generated/enum_fields.go | 25 +- bundle/schema/jsonschema.json | 256 ++++++++---------- .../model_provider_services/__init__.py | 6 - .../_models/inference_table_config.py | 76 ++---- .../_models/model_provider_service_config.py | 220 +++++---------- ...e_config_amazon_bedrock_provider_config.py | 26 +- ...g_amazon_bedrock_provider_direct_config.py | 60 ++-- ...ervice_config_anthropic_provider_config.py | 30 +- ...config_anthropic_provider_direct_config.py | 14 +- ...onfig_anthropic_provider_relayed_config.py | 35 +-- ...ayed_config_anthropic_relayed_plan_type.py | 29 -- ..._provider_service_config_aws_access_key.py | 24 +- ...ce_config_azure_open_ai_provider_config.py | 30 +- ...ig_azure_open_ai_provider_direct_config.py | 78 ++---- ...r_service_config_custom_provider_config.py | 27 +- ...ce_config_custom_provider_direct_config.py | 33 +-- ..._service_config_entra_service_principal.py | 35 +-- ...onfig_gemini_enterprise_provider_config.py | 18 +- ...emini_enterprise_provider_direct_config.py | 38 +-- ...onfig_microsoft_foundry_provider_config.py | 38 +-- ...icrosoft_foundry_provider_direct_config.py | 78 ++---- ...ider_service_config_model_target_config.py | 40 +-- ..._service_config_open_ai_provider_config.py | 8 +- ...e_config_open_ai_provider_direct_config.py | 28 +- ...provider_service_config_provider_secret.py | 16 +- ...vider_service_config_service_credential.py | 25 +- .../_models/rate_limit.py | 92 ++----- .../_models/rate_limit_rate_limit_key.py | 2 - 30 files changed, 422 insertions(+), 970 deletions(-) delete mode 100644 python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config_anthropic_relayed_plan_type.py diff --git a/acceptance/bundle/refschema/out.fields.txt b/acceptance/bundle/refschema/out.fields.txt index 8f4cd995787..faadf3d8dbe 100644 --- a/acceptance/bundle/refschema/out.fields.txt +++ b/acceptance/bundle/refschema/out.fields.txt @@ -2120,7 +2120,6 @@ resources.model_provider_services.*.config.anthropic.direct *catalog.ModelProvid resources.model_provider_services.*.config.anthropic.direct.api_key *catalog.ModelProviderServiceConfigProviderSecret ALL resources.model_provider_services.*.config.anthropic.direct.api_key.plaintext string ALL resources.model_provider_services.*.config.anthropic.relayed *catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfig ALL -resources.model_provider_services.*.config.anthropic.relayed.plan_type catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType ALL resources.model_provider_services.*.config.azure_openai *catalog.ModelProviderServiceConfigAzureOpenAiProviderConfig ALL resources.model_provider_services.*.config.azure_openai.direct *catalog.ModelProviderServiceConfigAzureOpenAiProviderDirectConfig ALL resources.model_provider_services.*.config.azure_openai.direct.api_key *catalog.ModelProviderServiceConfigProviderSecret ALL @@ -2148,7 +2147,6 @@ resources.model_provider_services.*.config.gemini_enterprise.direct.api_key.plai resources.model_provider_services.*.config.gemini_enterprise.direct.project_id string ALL resources.model_provider_services.*.config.gemini_enterprise.direct.region string ALL resources.model_provider_services.*.config.inference_table *catalog.InferenceTableConfig ALL -resources.model_provider_services.*.config.inference_table.disabled bool ALL resources.model_provider_services.*.config.inference_table.is_deleted bool ALL resources.model_provider_services.*.config.inference_table.parent string ALL resources.model_provider_services.*.config.inference_table.table string ALL @@ -2177,8 +2175,6 @@ resources.model_provider_services.*.config.rate_limits[*] catalog.RateLimit ALL resources.model_provider_services.*.config.rate_limits[*].key catalog.RateLimitRateLimitKey ALL resources.model_provider_services.*.config.rate_limits[*].principal string ALL resources.model_provider_services.*.config.rate_limits[*].renewal_period catalog.RateLimitRateLimitRenewalPeriod ALL -resources.model_provider_services.*.config.rate_limits[*].request_tag_key string ALL -resources.model_provider_services.*.config.rate_limits[*].request_tag_value string ALL resources.model_provider_services.*.config.rate_limits[*].requests int64 ALL resources.model_provider_services.*.config.rate_limits[*].tokens int64 ALL resources.model_provider_services.*.config.targets []catalog.ModelProviderServiceConfigModelTargetConfig ALL diff --git a/bundle/direct/dresources/model_provider_service.go b/bundle/direct/dresources/model_provider_service.go index 959dff9baca..ebf02e9c3f6 100644 --- a/bundle/direct/dresources/model_provider_service.go +++ b/bundle/direct/dresources/model_provider_service.go @@ -75,7 +75,6 @@ func modelProviderServiceBody(config *resources.ModelProviderServiceConfig) cata Etag: "", MetastoreId: "", Name: "", - Owner: "", UpdateTime: nil, UpdatedBy: "", ForceSendFields: nil, diff --git a/bundle/internal/validation/generated/enum_fields.go b/bundle/internal/validation/generated/enum_fields.go index 7330663133f..464afe2f97d 100644 --- a/bundle/internal/validation/generated/enum_fields.go +++ b/bundle/internal/validation/generated/enum_fields.go @@ -39,7 +39,7 @@ var EnumFields = map[string][]string{ "resources.apps.*.resources[*].uc_securable.permission": {"EXECUTE", "MODIFY", "READ_VOLUME", "SELECT", "USE_CONNECTION", "WRITE_VOLUME"}, "resources.apps.*.resources[*].uc_securable.securable_type": {"CONNECTION", "FUNCTION", "TABLE", "VOLUME"}, - "resources.catalogs.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.catalogs.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, "resources.cluster_policies.*.permissions[*].level": {"CAN_USE"}, @@ -63,7 +63,7 @@ var EnumFields = map[string][]string{ "resources.experiments.*.permissions[*].level": {"CAN_EDIT", "CAN_MANAGE", "CAN_READ"}, "resources.external_locations.*.encryption_details.sse_encryption_details.algorithm": {"AWS_SSE_KMS", "AWS_SSE_S3"}, - "resources.external_locations.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.external_locations.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, "resources.genie_spaces.*.permissions[*].level": {"CAN_ATTACH_TO", "CAN_BIND", "CAN_CREATE", "CAN_CREATE_APP", "CAN_EDIT", "CAN_EDIT_METADATA", "CAN_MANAGE", "CAN_MANAGE_PRODUCTION_VERSIONS", "CAN_MANAGE_RUN", "CAN_MANAGE_STAGING_VERSIONS", "CAN_MONITOR", "CAN_MONITOR_ONLY", "CAN_QUERY", "CAN_READ", "CAN_RESTART", "CAN_RUN", "CAN_USE", "CAN_VIEW", "CAN_VIEW_METADATA", "IS_OWNER"}, @@ -100,11 +100,11 @@ var EnumFields = map[string][]string{ "resources.jobs.*.schedule.pause_status": {"PAUSED", "UNPAUSED"}, "resources.jobs.*.schedule.sql_condition.trigger_mode": {"QUERY_RETURNS_ROWS", "RESULT_VALUE_CHANGES"}, "resources.jobs.*.tasks[*].ai_runtime_task.deployments[*].compute.accelerator_type": {"GPU_1xA10", "GPU_1xH100", "GPU_8xH100"}, - "resources.jobs.*.tasks[*].compute.hardware_accelerator": {"GPU_1xA10", "GPU_1xH100", "GPU_8xH100"}, + "resources.jobs.*.tasks[*].compute.hardware_accelerator": {"GPU_1xA10", "GPU_1xH100", "GPU_8xB300", "GPU_8xH100"}, "resources.jobs.*.tasks[*].condition_task.op": {"EQUAL_TO", "GREATER_THAN", "GREATER_THAN_OR_EQUAL", "LESS_THAN", "LESS_THAN_OR_EQUAL", "NOT_EQUAL"}, "resources.jobs.*.tasks[*].dbt_task.source": {"GIT", "WORKSPACE"}, "resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments[*].compute.accelerator_type": {"GPU_1xA10", "GPU_1xH100", "GPU_8xH100"}, - "resources.jobs.*.tasks[*].for_each_task.task.compute.hardware_accelerator": {"GPU_1xA10", "GPU_1xH100", "GPU_8xH100"}, + "resources.jobs.*.tasks[*].for_each_task.task.compute.hardware_accelerator": {"GPU_1xA10", "GPU_1xH100", "GPU_8xB300", "GPU_8xH100"}, "resources.jobs.*.tasks[*].for_each_task.task.condition_task.op": {"EQUAL_TO", "GREATER_THAN", "GREATER_THAN_OR_EQUAL", "LESS_THAN", "LESS_THAN_OR_EQUAL", "NOT_EQUAL"}, "resources.jobs.*.tasks[*].for_each_task.task.dbt_task.source": {"GIT", "WORKSPACE"}, "resources.jobs.*.tasks[*].for_each_task.task.gen_ai_compute_task.source": {"GIT", "WORKSPACE"}, @@ -158,15 +158,14 @@ var EnumFields = map[string][]string{ "resources.jobs.*.triggers[*].sql_condition.trigger_mode": {"QUERY_RETURNS_ROWS", "RESULT_VALUE_CHANGES"}, "resources.jobs.*.triggers[*].table_update.condition": {"ALL_UPDATED", "ANY_UPDATED"}, - "resources.mcp_services.*.config.rate_limits[*].key": {"RATE_LIMIT_KEY_REQUEST_TAG", "RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"}, + "resources.mcp_services.*.config.rate_limits[*].key": {"RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"}, "resources.mcp_services.*.config.rate_limits[*].renewal_period": {"RATE_LIMIT_RENEWAL_PERIOD_HOUR", "RATE_LIMIT_RENEWAL_PERIOD_MINUTE"}, - "resources.model_provider_services.*.config.anthropic.relayed.plan_type": {"ANTHROPIC_RELAYED_PLAN_TYPE_MAX", "ANTHROPIC_RELAYED_PLAN_TYPE_TEAM_ENTERPRISE"}, "resources.model_provider_services.*.config.provider_type": {"EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK", "EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC", "EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI", "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM", "EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE", "EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY", "EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI"}, - "resources.model_provider_services.*.config.rate_limits[*].key": {"RATE_LIMIT_KEY_REQUEST_TAG", "RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"}, + "resources.model_provider_services.*.config.rate_limits[*].key": {"RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"}, "resources.model_provider_services.*.config.rate_limits[*].renewal_period": {"RATE_LIMIT_RENEWAL_PERIOD_HOUR", "RATE_LIMIT_RENEWAL_PERIOD_MINUTE"}, - "resources.model_services.*.config.rate_limits[*].key": {"RATE_LIMIT_KEY_REQUEST_TAG", "RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"}, + "resources.model_services.*.config.rate_limits[*].key": {"RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"}, "resources.model_services.*.config.rate_limits[*].renewal_period": {"RATE_LIMIT_RENEWAL_PERIOD_HOUR", "RATE_LIMIT_RENEWAL_PERIOD_MINUTE"}, "resources.model_services.*.config.routing.destinations[*].destination_type": {"DESTINATION_TYPE_EXTERNAL_FOUNDATION_MODEL", "DESTINATION_TYPE_PAY_PER_TOKEN_FOUNDATION_MODEL", "DESTINATION_TYPE_PROVISIONED_THROUGHPUT_FOUNDATION_MODEL"}, "resources.model_services.*.config.routing.fallback.destinations[*].destination_type": {"DESTINATION_TYPE_EXTERNAL_FOUNDATION_MODEL", "DESTINATION_TYPE_PAY_PER_TOKEN_FOUNDATION_MODEL", "DESTINATION_TYPE_PROVISIONED_THROUGHPUT_FOUNDATION_MODEL"}, @@ -262,14 +261,14 @@ var EnumFields = map[string][]string{ "resources.quality_monitors.*.inference_log.problem_type": {"PROBLEM_TYPE_CLASSIFICATION", "PROBLEM_TYPE_REGRESSION"}, "resources.quality_monitors.*.schedule.pause_status": {"PAUSED", "UNPAUSED", "UNSPECIFIED"}, - "resources.registered_models.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.registered_models.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, - "resources.schemas.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.schemas.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, "resources.secret_scopes.*.backend_type": {"AZURE_KEYVAULT", "DATABRICKS"}, "resources.secret_scopes.*.permissions[*].level": {"READ", "WRITE", "MANAGE"}, - "resources.secrets.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.secrets.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, "resources.sql_warehouses.*.channel.name": {"CHANNEL_NAME_CURRENT", "CHANNEL_NAME_CUSTOM", "CHANNEL_NAME_PREVIEW", "CHANNEL_NAME_PREVIOUS"}, "resources.sql_warehouses.*.permissions[*].level": {"CAN_MANAGE", "CAN_MONITOR", "CAN_USE", "CAN_VIEW", "IS_OWNER"}, @@ -288,11 +287,11 @@ var EnumFields = map[string][]string{ "resources.vector_search_endpoints.*.permissions[*].level": {"CAN_CREATE", "CAN_MANAGE", "CAN_USE"}, "resources.vector_search_indexes.*.delta_sync_index_spec.pipeline_type": {"CONTINUOUS", "TRIGGERED"}, - "resources.vector_search_indexes.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.vector_search_indexes.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, "resources.vector_search_indexes.*.index_subtype": {"FULL_TEXT", "HYBRID", "VECTOR"}, "resources.vector_search_indexes.*.index_type": {"DELTA_SYNC", "DIRECT_ACCESS"}, - "resources.volumes.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, + "resources.volumes.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, "resources.volumes.*.volume_type": {"EXTERNAL", "MANAGED"}, "variables.*.type": {"complex"}, diff --git a/bundle/schema/jsonschema.json b/bundle/schema/jsonschema.json index cbee78b1fea..fc398289193 100644 --- a/bundle/schema/jsonschema.json +++ b/bundle/schema/jsonschema.json @@ -5532,82 +5532,82 @@ "oneOf": [ { "type": "object", - "description": "Behavioral configuration for a ModelProviderService: provider connection\n(auth + provider-specific fields), the catalog of models this provider\nservice can route to, and the passthrough policy that governs how request\nheaders, query parameters, and unmanaged subpaths cross the trust boundary\nto the upstream provider.", + "description": "Behavioral configuration for a ModelProviderService: provider authentication\nand provider-specific fields, the catalog of models this provider\nservice can route to, and the passthrough policy that governs how request\nheaders, query parameters, and unmanaged subpaths cross the trust boundary\nto the upstream provider.", "properties": { "allow_all_targets": { - "description": "[Beta] When true, accepts any model exposed by the upstream provider; `targets`\nis not required and does not restrict routability. When false, only\nmodels listed in `targets` are routable.", + "description": "When true, accepts any model exposed by the upstream provider; `targets`\nis not required and does not restrict routability. When false, only\nmodels listed in `targets` are routable. Defaults to false.", "$ref": "#/$defs/bool", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "amazon_bedrock": { - "description": "[Beta] Amazon Bedrock provider configuration.", + "description": "Amazon Bedrock provider configuration.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAmazonBedrockProviderConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "anthropic": { - "description": "[Beta] Anthropic provider configuration. Exactly one of `direct` or `relayed` must\nbe set on Create; the two are mutually exclusive.", + "description": "Anthropic provider configuration. Exactly one of `direct` or `relayed` must\nbe set on Create; the two are mutually exclusive.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAnthropicProviderConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "azure_openai": { - "description": "[Beta] Azure OpenAI provider configuration.", + "description": "Azure OpenAI provider configuration.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAzureOpenAiProviderConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "custom": { - "description": "[Beta] Custom provider configuration: arbitrary HTTP endpoint with bearer-token auth.", + "description": "Custom OpenAI-compatible provider configuration with bearer-token\nauthentication.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigCustomProviderConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "forward_headers": { - "description": "[Beta] Whether to forward incoming request headers to the upstream provider.\nApplies to managed (multi-model) requests as well as passthrough requests\nserved by this provider service. Governance-level decision by the provider\nservice owner; not selectable per inference call.", + "description": "Whether to forward incoming HTTP headers to the upstream provider. Defaults\nto false and is configured for the entire provider service, not per request.\nUpstream authentication is configured separately in the provider-specific\nconfiguration.", "$ref": "#/$defs/bool", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "forward_query_parameters": { - "description": "[Beta] Whether to forward incoming request query parameters to the upstream\nprovider. Same trust-boundary semantics as `forward_headers`.", + "description": "Whether to forward incoming query parameters to the upstream provider.\nDefaults to false and is configured for the entire provider service, not\nper request.", "$ref": "#/$defs/bool", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "forward_unmanaged_paths": { - "description": "[Beta] Whether to forward request paths that fall outside this service's managed\nAPI set to the upstream provider as opaque passthrough. When true,\nrequests addressed to subpaths not recognized by the managed API surface\nare proxied to the upstream provider over the same provider connection.\nWhen false, only managed-API paths are served. Governance-level decision\nby the provider service owner; expanding this expands the trust boundary\nthat the ModelProviderService exposes.", + "description": "Whether to proxy paths that AI Gateway does not recognize as configured\nprovider-native API types. Defaults to false. When true, these paths are\nforwarded unchanged to the upstream provider. When false, only\nrecognized API paths are served. Enabling this broadens the upstream API\nsurface exposed through the provider service.", "$ref": "#/$defs/bool", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "gemini_enterprise": { - "description": "[Beta] Gemini Enterprise provider configuration.", + "description": "Gemini Enterprise provider configuration.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigGeminiEnterpriseProviderConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "inference_table": { - "description": "[Beta] Inference table configuration for payload logging when this provider\nservice is invoked directly. When it is invoked through a model service,\nthe model service's own inference table captures the invocation instead.\nMirrors `ModelServiceConfig.inference_table` /\n`AgentServiceConfig.inference_table`.", + "description": "Payload logging configuration for requests sent directly to this provider\nservice. Requests routed through a model service are captured by that model\nservice's inference table instead.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.InferenceTableConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "microsoft_foundry": { - "description": "[Beta] Microsoft Foundry provider configuration.", + "description": "Microsoft Foundry provider configuration.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigMicrosoftFoundryProviderConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "openai": { - "description": "[Beta] OpenAI provider configuration.", + "description": "OpenAI provider configuration.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigOpenAiProviderConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "provider_type": { - "description": "[Beta] Provider type discriminator. Required at create time; immutable after.\nDetermines which variant of the `provider` oneof must be set. May not be\nchanged via Update; attempts to include `config.provider_type` in\n`UpdateModelProviderServiceRequest.update_mask` are rejected.\n\nRequired on CreateModelProviderService and immutable thereafter.", + "description": "External model provider. Required on Create and immutable thereafter. Set\nthe matching provider-specific configuration, such as `openai`,\n`azure_openai`, or `amazon_bedrock`.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigExternalModelProviderType", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "rate_limits": { - "description": "[Beta] Rate limits applied when this provider service is invoked directly. When\nit is invoked through a model service, the model service's own\n`rate_limits` apply instead. Mirrors `ModelServiceConfig.rate_limits` /\n`McpServiceConfig.rate_limits`.", + "description": "Rate limits for requests sent directly to this provider service. Requests\nrouted through a model service use that model service's rate limits instead.", "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.RateLimit", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "targets": { - "description": "[Beta] Routing targets this provider service exposes (provider-side model\nidentifier + unified API types per entry). Required (\u003e=1) when\n`allow_all_targets = false`; optional and additive when\n`allow_all_targets = true`. References from `ExternalModelConfig.target`\nmust match an entry here unless `allow_all_targets = true`.", + "description": "Models and provider-native API types exposed by this provider service. Each\nentry must include at least one `native_api_types` value. When\n`allow_all_targets` is false, at least one entry is required and model\nservice destinations can reference only listed models. When\n`allow_all_targets` is true, any upstream model is routable; entries in\nthis list provide API-type metadata without restricting other models.", "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigModelTargetConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -5625,9 +5625,9 @@ "description": "Amazon Bedrock provider configuration.", "properties": { "direct": { - "description": "[Beta] Direct form of Amazon Bedrock provider config.\n\nAuthentication is one of two mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- Access keys: set `aws_access_key`, leave `service_credential` unset.\n- UC service credential: set `service_credential.name` to the AIP-122\nresource-name form `credentials/{name}`, leave `aws_access_key` unset. The\ncredential value lives in UC and is referenced by name, not held on this\nmessage.\nSetting more than one mode is rejected.", + "description": "Amazon Bedrock region and authentication configuration.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAmazonBedrockProviderDirectConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -5642,22 +5642,22 @@ "oneOf": [ { "type": "object", - "description": "Direct form of Amazon Bedrock provider config.\n\nAuthentication is one of two mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- Access keys: set `aws_access_key`, leave `service_credential` unset.\n- UC service credential: set `service_credential.name` to the AIP-122\nresource-name form `credentials/{name}`, leave `aws_access_key` unset. The\ncredential value lives in UC and is referenced by name, not held on this\nmessage.\nSetting more than one mode is rejected.", + "description": "Direct form of Amazon Bedrock provider config.\n\nAuthentication is one of two mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- Access keys: set `aws_access_key`, leave `service_credential` unset.\n- Unity Catalog service credential: set `service_credential.name` to the\nresource name `credentials/{name}`, leave `aws_access_key` unset. The\ncredential value lives in Unity Catalog and is referenced by name, not\nheld on this message.\nSetting more than one mode is rejected.", "properties": { "aws_access_key": { - "description": "[Beta] AWS access-key-pair auth. Mutually exclusive with `service_credential`.", + "description": "AWS access-key-pair authentication. Set `access_key_id` and\n`secret_access_key.plaintext`. Mutually exclusive with\n`service_credential`.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAwsAccessKey", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "region": { - "description": "[Beta] AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`).\nRequired on Create.", + "description": "AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`).\nRequired on Create.", "$ref": "#/$defs/string", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "service_credential": { - "description": "[Beta] Reference to a UC service credential authorizing Bedrock requests. On\nCreate the caller supplies `service_credential.name` in the AIP-122\nresource-name form `credentials/{name}`. Required on Create when using\nUC-service-credential auth; mutually exclusive with `aws_access_key`. The\ncredential is referenced by name; its value is not carried here. On read the\nresolved `id` and `is_deleted` are also populated. Only supported on AWS-hosted\nworkspaces; Create requests from other clouds are rejected with\nINVALID_PARAMETER_VALUE.", + "description": "Reference to a Unity Catalog service credential authorizing Bedrock\nrequests. On Create, supply `service_credential.name` in the form\n`credentials/{name}`. Required on Create when using service-credential\nauthentication; mutually exclusive with `aws_access_key`. The credential\nis referenced by name; its value is not carried here. Only\nsupported on AWS-hosted workspaces.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigServiceCredential", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -5675,14 +5675,14 @@ "description": "Anthropic provider configuration. Exactly one of `direct` or `relayed` must\nbe set on Create; the two are mutually exclusive.", "properties": { "direct": { - "description": "[Beta] Direct (inline-credentials) form: caller supplies the API key in the\nrequest body. Required on Create unless `relayed` is set.", + "description": "Direct authentication with an API key supplied in\n`direct.api_key.plaintext`. Required unless `relayed` is set.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAnthropicProviderDirectConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "relayed": { - "description": "[Beta] Relayed (credential-less) form: no Anthropic credential is stored. Each\ninference request instead carries the caller's own OAuth token, which the\nplatform forwards to Anthropic on outbound requests. Mutually exclusive\nwith `direct`; no `api_key` is required or persisted.", + "description": "Relayed authentication. Each inference request supplies the caller's\nOAuth token, which is forwarded to Anthropic. No Anthropic credential is\nstored. Mutually exclusive with `direct`.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -5700,9 +5700,9 @@ "description": "Direct form of Anthropic provider config.", "properties": { "api_key": { - "description": "[Beta] Anthropic API key. Required on Create. Sent as the `x-api-key` header on\noutbound requests. Supplied as inline plaintext via\n`ProviderSecret.plaintext`.", + "description": "Anthropic API key. Required when creating the service. Supply the value\nin `api_key.plaintext`.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -5717,14 +5717,7 @@ "oneOf": [ { "type": "object", - "description": "Relayed form of Anthropic provider config: no credential is stored.\nAuthentication is the caller's own OAuth token, forwarded to Anthropic on\noutbound requests, so there is no persisted secret. Presence of this variant\nis the signal that the provider service uses relayed auth; `plan_type`\nfurther distinguishes which Anthropic subscription tier the token belongs to.", - "properties": { - "plan_type": { - "description": "[Beta] Which Anthropic subscription tier the relayed token belongs to. Optional;\nwhen unset the MPS gets the full governance surface (see TEAM_ENTERPRISE).\nImmutable after Create, so the tier cannot be flipped in place.", - "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType", - "x-databricks-launch-stage": "PUBLIC_BETA" - } - }, + "description": "Relayed Anthropic provider configuration. Each inference request supplies\nthe caller's OAuth token, which is forwarded to Anthropic. No Anthropic\ncredential is stored.", "additionalProperties": false }, { @@ -5733,26 +5726,6 @@ } ] }, - "catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType": { - "oneOf": [ - { - "type": "string", - "description": "Which Anthropic subscription tier the relayed OAuth token belongs to.\nImmutable after Create (switching tiers changes which governance controls\nthe platform enforces). Only MAX and TEAM_ENTERPRISE differ in the\ngovernance surface the gateway can enforce, not in how the token is\nrelayed.", - "enum": [ - "ANTHROPIC_RELAYED_PLAN_TYPE_MAX", - "ANTHROPIC_RELAYED_PLAN_TYPE_TEAM_ENTERPRISE" - ], - "enumDescriptions": [ - "[Beta]", - "[Beta]" - ] - }, - { - "type": "string", - "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}" - } - ] - }, "catalog.ModelProviderServiceConfigAwsAccessKey": { "oneOf": [ { @@ -5760,14 +5733,14 @@ "description": "AWS access-key-pair auth for Amazon Bedrock: a SigV4-signing key pair.", "properties": { "access_key_id": { - "description": "[Beta] AWS access key ID. Required on Create when using access-key auth. Treated as\nusername-equivalent (not a secret value): round-trips on reads and is\nscrubbed from audit logs.", + "description": "AWS access key ID. Required on Create when using access-key auth. Treated as\nusername-equivalent (not a secret value): round-trips on reads and is\nscrubbed from audit logs.", "$ref": "#/$defs/string", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "secret_access_key": { - "description": "[Beta] AWS secret access key paired with `access_key_id`. Required on Create when\nusing access-key auth. Supplied as inline plaintext via\n`ProviderSecret.plaintext`.", + "description": "AWS secret access key paired with `access_key_id`. Required when creating\na service with access-key authentication. Supply the value in\n`secret_access_key.plaintext`.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -5785,9 +5758,9 @@ "description": "Azure OpenAI provider configuration.", "properties": { "direct": { - "description": "[Beta] Direct form of Azure OpenAI provider config. Exactly one of three\nmutually-exclusive auth modes must be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset.\n- UC service credential: set `service_credential.name` to the AIP-122\nresource-name form `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in UC and is\nreferenced by name, not held on this message. Only supported on\nAzure-hosted workspaces.\nSetting more than one mode is rejected.", + "description": "Azure OpenAI endpoint and authentication configuration.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAzureOpenAiProviderDirectConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -5802,27 +5775,27 @@ "oneOf": [ { "type": "object", - "description": "Direct form of Azure OpenAI provider config. Exactly one of three\nmutually-exclusive auth modes must be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset.\n- UC service credential: set `service_credential.name` to the AIP-122\nresource-name form `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in UC and is\nreferenced by name, not held on this message. Only supported on\nAzure-hosted workspaces.\nSetting more than one mode is rejected.", + "description": "Direct form of Azure OpenAI provider config. Exactly one of three\nmutually-exclusive auth modes must be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset.\n- Unity Catalog service credential: set `service_credential.name` to the\nresource name `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in Unity\nCatalog and is referenced by name, not held on this message. Only\nsupported on Azure-hosted workspaces.\nSetting more than one mode is rejected.", "properties": { "api_key": { - "description": "[Beta] Azure OpenAI API key. Mutually exclusive with the Entra and\nservice-credential modes. Supplied as inline plaintext via\n`ProviderSecret.plaintext`.", + "description": "Azure OpenAI API key. Supply the value in `api_key.plaintext`. Mutually\nexclusive with Entra ID and Unity Catalog service credential\nauthentication.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "base_url": { - "description": "[Beta] Full Azure OpenAI endpoint base URL, e.g.\n`https://myresource.openai.azure.com`. Required on Create.", + "description": "Full Azure OpenAI endpoint base URL, e.g.\n`https://myresource.openai.azure.com`. Required on Create.", "$ref": "#/$defs/string", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "entra_service_principal": { - "description": "[Beta] Entra ID (service principal) auth. Mutually exclusive with `api_key` and\n`service_credential`.", + "description": "Entra ID service-principal authentication. Set `tenant_id`, `client_id`,\nand `client_secret.plaintext`. Mutually exclusive with `api_key` and\n`service_credential`.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigEntraServicePrincipal", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "service_credential": { - "description": "[Beta] Reference to a UC service credential authorizing Azure OpenAI requests. On\nCreate the caller supplies `service_credential.name` in the AIP-122\nresource-name form `credentials/{name}`. Required on Create when using\nUC-service-credential auth; mutually exclusive with `api_key` and\n`entra_service_principal`. The credential is\nreferenced by name; its value is not carried here. On read the resolved `id`\nand `is_deleted` are also populated. Only supported on Azure-hosted\nworkspaces; Create requests from other clouds are rejected with\nINVALID_PARAMETER_VALUE.", + "description": "Reference to a Unity Catalog service credential authorizing Azure OpenAI\nrequests. On Create, supply `service_credential.name` in the form\n`credentials/{name}`. Required on Create when using service-credential\nauthentication; mutually exclusive with `api_key` and\n`entra_service_principal`. The credential is referenced by name; its value\nis not carried here. Only supported on Azure-hosted workspaces.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigServiceCredential", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -5837,12 +5810,12 @@ "oneOf": [ { "type": "object", - "description": "Custom provider configuration: arbitrary HTTP endpoint with bearer-token auth.", + "description": "Custom OpenAI-compatible provider configuration with bearer-token\nauthentication.", "properties": { "direct": { - "description": "[Beta] Direct form of custom provider config.\n\nAuthentication is one of two mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- Bearer: set `api_key`, leave `header_auth` unset. The secret is\nforwarded as `Authorization: Bearer \u003csecret\u003e`.\n- Header: set `header_auth`, leave `api_key` unset. The secret is\nforwarded as `\u003capi_key_name\u003e: \u003capi_key_value\u003e`.\nSetting both modes or neither mode is rejected.", + "description": "Endpoint and authentication configuration for the custom provider.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigCustomProviderDirectConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -5857,17 +5830,17 @@ "oneOf": [ { "type": "object", - "description": "Direct form of custom provider config.\n\nAuthentication is one of two mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- Bearer: set `api_key`, leave `header_auth` unset. The secret is\nforwarded as `Authorization: Bearer \u003csecret\u003e`.\n- Header: set `header_auth`, leave `api_key` unset. The secret is\nforwarded as `\u003capi_key_name\u003e: \u003capi_key_value\u003e`.\nSetting both modes or neither mode is rejected.", + "description": "Direct form of a custom provider configuration. Set `api_key` to the bearer\ntoken sent in the `Authorization` header.", "properties": { "api_key": { - "description": "[Beta] Bearer token forwarded as the `Authorization: Bearer ...` header on\noutbound requests. Supplied as inline plaintext via\n`ProviderSecret.plaintext`. Set this for bearer-token auth.", + "description": "Bearer token forwarded in the `Authorization` header. Supply the value\nin `api_key.plaintext`.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "base_url": { - "description": "[Beta] Endpoint URL of the OpenAI-compatible service (e.g.,\n`https://api.example.com/v1`). Required on Create.", + "description": "Endpoint URL of the OpenAI-compatible service (e.g.,\n`https://api.example.com/v1`). Required on Create.", "$ref": "#/$defs/string", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -5882,22 +5855,22 @@ "oneOf": [ { "type": "object", - "description": "Entra ID (Azure AD) service-principal auth: AI Gateway exchanges the\n`tenant_id` + `client_id` identify the service principal, and the `credential`\noneof proves that identity, exchanged for an Entra bearer token on outbound\nrequests via the OAuth2 client-credentials grant. Shared by the Azure OpenAI\nand Microsoft Foundry provider configs.", + "description": "Entra ID (Azure AD) service-principal authentication. The `tenant_id` and\n`client_id` identify the service principal, and `client_secret` authenticates\nit. AI Gateway exchanges these credentials for an Entra bearer token for\nrequests to Azure OpenAI or Microsoft Foundry.", "properties": { "client_id": { - "description": "[Beta] Entra ID client (application) ID. Required on Create.", + "description": "Entra ID client (application) ID. Required on Create.", "$ref": "#/$defs/string", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "client_secret": { - "description": "[Beta] Entra ID client secret. Supplied as inline plaintext via\n`ProviderSecret.plaintext`.", + "description": "Entra ID client secret. Supply the value in `client_secret.plaintext`.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "tenant_id": { - "description": "[Beta] Entra ID (Azure AD) tenant ID. Required on Create.", + "description": "Entra ID (Azure AD) tenant ID. Required on Create.", "$ref": "#/$defs/string", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -5921,15 +5894,6 @@ "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM", "EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY", "EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE" - ], - "enumDescriptions": [ - "[Beta]", - "[Beta]", - "[Beta]", - "[Beta]", - "[Beta]", - "[Beta]", - "[Beta]" ] }, { @@ -5945,9 +5909,9 @@ "description": "Gemini Enterprise provider configuration.", "properties": { "direct": { - "description": "[Beta] Direct form of Gemini Enterprise provider config.\n\nAuthentication is one of two mutually exclusive modes; exactly one must be\nsupplied on Create:\n- API key: set `api_key`, leave `service_credential` unset.\n- UC service credential: set `service_credential`, leave `api_key` unset.", + "description": "Gemini Enterprise project, region, and authentication configuration.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -5962,22 +5926,22 @@ "oneOf": [ { "type": "object", - "description": "Direct form of Gemini Enterprise provider config.\n\nAuthentication is one of two mutually exclusive modes; exactly one must be\nsupplied on Create:\n- API key: set `api_key`, leave `service_credential` unset.\n- UC service credential: set `service_credential`, leave `api_key` unset.", + "description": "Direct Gemini Enterprise provider configuration. An API key is required\nwhen creating the service.", "properties": { "api_key": { - "description": "[Beta] Google Gemini Enterprise API key. Required on Create when using API-key\nauth; mutually exclusive with `service_credential`. Supplied as inline\nplaintext via `ProviderSecret.plaintext`.", + "description": "Google Gemini Enterprise API key. Required when creating the service.\nSupply the value in `api_key.plaintext`.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "project_id": { - "description": "[Beta] GCP project ID hosting the Gemini Enterprise endpoint. Required on Create.", + "description": "GCP project ID hosting the Gemini Enterprise endpoint. Required on Create.", "$ref": "#/$defs/string", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "region": { - "description": "[Beta] GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`).\nRequired on Create.", + "description": "GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`).\nRequired on Create.", "$ref": "#/$defs/string", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -5995,9 +5959,9 @@ "description": "Microsoft Foundry provider configuration.", "properties": { "direct": { - "description": "[Beta] Direct form of Microsoft Foundry provider config.\n\nAuthentication is one of three mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset. AI Gateway exchanges these for\nan Entra bearer token on outbound requests via the OAuth2\nclient-credentials grant.\n- UC service credential: set `service_credential.name` to the AIP-122\nresource-name form `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in UC and is\nreferenced by name, not held on this message. Only supported on\nAzure-hosted workspaces.\nSetting more than one mode is rejected.", + "description": "Microsoft Foundry endpoint and authentication configuration.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -6012,27 +5976,27 @@ "oneOf": [ { "type": "object", - "description": "Direct form of Microsoft Foundry provider config.\n\nAuthentication is one of three mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset. AI Gateway exchanges these for\nan Entra bearer token on outbound requests via the OAuth2\nclient-credentials grant.\n- UC service credential: set `service_credential.name` to the AIP-122\nresource-name form `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in UC and is\nreferenced by name, not held on this message. Only supported on\nAzure-hosted workspaces.\nSetting more than one mode is rejected.", + "description": "Direct form of Microsoft Foundry provider config.\n\nAuthentication is one of three mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset. AI Gateway exchanges these for\nan Entra bearer token on outbound requests via the OAuth2\nclient-credentials grant.\n- Unity Catalog service credential: set `service_credential.name` to the\nresource name `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in Unity\nCatalog and is referenced by name, not held on this message. Only\nsupported on Azure-hosted workspaces.\nSetting more than one mode is rejected.", "properties": { "api_key": { - "description": "[Beta] Microsoft AI Foundry API key. Mutually exclusive with the Entra and\nservice-credential modes. Supplied as inline plaintext via\n`ProviderSecret.plaintext`.", + "description": "Microsoft Foundry API key. Supply the value in `api_key.plaintext`.\nMutually exclusive with Entra ID and Unity Catalog service credential\nauthentication.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "base_url": { - "description": "[Beta] Microsoft AI Foundry endpoint URL. Required on Create.", + "description": "Microsoft Foundry endpoint URL. Required on Create.", "$ref": "#/$defs/string", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "entra_service_principal": { - "description": "[Beta] Entra ID (service principal) auth. Mutually exclusive with `api_key` and\n`service_credential`.", + "description": "Entra ID service-principal authentication. Set `tenant_id`, `client_id`,\nand `client_secret.plaintext`. Mutually exclusive with `api_key` and\n`service_credential`.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigEntraServicePrincipal", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "service_credential": { - "description": "[Beta] Reference to a UC service credential authorizing Microsoft Foundry requests.\nOn Create the caller supplies `service_credential.name` in the AIP-122\nresource-name form `credentials/{name}`. Required on Create when using\nUC-service-credential auth; mutually exclusive with `api_key` and\n`entra_service_principal`. The credential is\nreferenced by name; its value is not carried here. On read the resolved `id`\nand `is_deleted` are also populated. Only supported on Azure-hosted\nworkspaces; Create requests from other clouds are rejected with\nINVALID_PARAMETER_VALUE.", + "description": "Reference to a Unity Catalog service credential authorizing Microsoft\nFoundry requests. On Create, supply `service_credential.name` in the form\n`credentials/{name}`. Required on Create when using service-credential\nauthentication; mutually exclusive with `api_key` and\n`entra_service_principal`. The credential is referenced by name; its value\nis not carried here. Only supported on Azure-hosted workspaces.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigServiceCredential", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -6078,9 +6042,9 @@ "description": "OpenAI provider configuration.", "properties": { "direct": { - "description": "[Beta] Direct (inline-credentials) form of the OpenAI provider config.", + "description": "OpenAI configuration with an API key supplied in the request.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigOpenAiProviderDirectConfig", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -6098,19 +6062,19 @@ "description": "Direct (inline-credentials) form of the OpenAI provider config.", "properties": { "api_key": { - "description": "[Beta] OpenAI API key. Required on Create. Supplied as inline plaintext via\n`ProviderSecret.plaintext`.", + "description": "OpenAI API key. Required when creating the service. Supply the value in\n`api_key.plaintext`.", "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "base_url": { - "description": "[Beta] Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for\nOpenAI-API-compatible third-party endpoints or in-network proxies.", + "description": "Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for\nOpenAI-API-compatible third-party endpoints or in-network proxies.", "$ref": "#/$defs/string", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" }, "organization": { - "description": "[Beta] Optional OpenAI organization ID. When set, the platform forwards it as\nthe `OpenAI-Organization` header.", + "description": "Optional OpenAI organization ID. When set, the platform forwards it as\nthe `OpenAI-Organization` header.", "$ref": "#/$defs/string", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -6128,9 +6092,9 @@ "description": "A secret value supplied as part of an inline provider config. The caller\nsupplies the value as inline `plaintext` on writes; the platform stores it\nencrypted. The `plaintext` field is `INPUT_ONLY` and never round-trips on\nreads.", "properties": { "plaintext": { - "description": "[Beta] Inline plaintext credential. INPUT_ONLY: the value never round-trips on\nreads. Get and List responses omit `plaintext`; the field's presence in\nthe read shape only indicates that a secret is configured.", + "description": "Inline plaintext credential. INPUT_ONLY: the value never round-trips on\nreads. Get and List responses omit `plaintext`; the enclosing secret\nobject remains present to indicate that a secret is configured.", "$ref": "#/$defs/string", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false @@ -6145,12 +6109,12 @@ "oneOf": [ { "type": "object", - "description": "---- Provider configuration (nested; see the `provider` oneof below) ----\nThe customer-owned UC service credential a ModelProviderService uses to\nauthenticate to its provider, referenced by name.", + "description": "The customer-owned Unity Catalog service credential a model provider service\nuses to authenticate to its provider, referenced by name.", "properties": { "name": { - "description": "[Beta] Resource name of the bound UC service credential, in the AIP-122 form\n`credentials/{name}` (a metastore-level single-part credential name). On\ncreate the caller supplies the name here. On read it reflects the\ncredential's current name at read time.", + "description": "Resource name of the bound Unity Catalog service credential, in the form\n`credentials/{name}`. Supply this field when creating the service or\nrebinding its credential. On read, it reflects the credential's current\nname.", "$ref": "#/$defs/string", - "x-databricks-launch-stage": "PUBLIC_BETA" + "x-databricks-launch-stage": "GA" } }, "additionalProperties": false, diff --git a/python/databricks/bundles/model_provider_services/__init__.py b/python/databricks/bundles/model_provider_services/__init__.py index 5231f6440d3..17a2fb82470 100644 --- a/python/databricks/bundles/model_provider_services/__init__.py +++ b/python/databricks/bundles/model_provider_services/__init__.py @@ -22,8 +22,6 @@ "ModelProviderServiceConfigAnthropicProviderDirectConfigDict", "ModelProviderServiceConfigAnthropicProviderDirectConfigParam", "ModelProviderServiceConfigAnthropicProviderRelayedConfig", - "ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType", - "ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanTypeParam", "ModelProviderServiceConfigAnthropicProviderRelayedConfigDict", "ModelProviderServiceConfigAnthropicProviderRelayedConfigParam", "ModelProviderServiceConfigAwsAccessKey", @@ -132,10 +130,6 @@ ModelProviderServiceConfigAnthropicProviderRelayedConfigDict, ModelProviderServiceConfigAnthropicProviderRelayedConfigParam, ) -from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_relayed_config_anthropic_relayed_plan_type import ( - ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType, - ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanTypeParam, -) from databricks.bundles.model_provider_services._models.model_provider_service_config_aws_access_key import ( ModelProviderServiceConfigAwsAccessKey, ModelProviderServiceConfigAwsAccessKeyDict, diff --git a/python/databricks/bundles/model_provider_services/_models/inference_table_config.py b/python/databricks/bundles/model_provider_services/_models/inference_table_config.py index 77e4ff25560..45165416e17 100644 --- a/python/databricks/bundles/model_provider_services/_models/inference_table_config.py +++ b/python/databricks/bundles/model_provider_services/_models/inference_table_config.py @@ -14,46 +14,25 @@ @dataclass(kw_only=True) class InferenceTableConfig: """ - Inference table configuration for payload logging on a model service. - - `parent` is always REQUIRED when the sub-message is set; the destination - UC schema is needed to construct or rebind the payload TABLE regardless of - whether payload logging is currently active. Payload logging is active by - default; set `disabled = true` to pause runtime logging without dropping the - table or the binding. + Configuration for logging request and response payloads to a Unity Catalog + inference table. When this configuration is present, payload logging is + enabled by default. """ parent: VariableOr[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Parent UC schema where the inference table is created. - Format: `schemas/{catalog}.{schema}`. Set at create time and immutable - thereafter; changing it on an existing service is rejected. - """ - - disabled: VariableOrOptional[bool] = None - """ - :meta private: [EXPERIMENTAL] - - [Beta] Indicates whether payload logging is disabled (opt-out). Unset means that - payload logging is active (the on-by-default state coincides with the proto - zero-value, so the server never fills this field for a client that leaves it - unset). Set `disabled = true` to pause runtime logging while keeping the - sub-message attached (preserving `parent` and `table_name_prefix` for a - later flip back to active). `parent` remains required either way. + Parent Unity Catalog schema where the inference table is created, in the + form `schemas/{catalog}.{schema}`. Required when configuring an inference + table. After the inference table is created, this field cannot be changed. """ table_name_prefix: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Prefix for the inference-table's UC-registered name. The actual leaf name UC - stores is `_payload`; the `_payload` suffix is appended - automatically. To find the actual UC table after Create, read the `table` - field on the response. Defaults to `_payload` when unset. - Set at create time and immutable thereafter; changing it on an existing - service is rejected. + Prefix used to form the inference table's registered name. AI Gateway + appends `_payload`; for example, `table_name_prefix = "orders"` creates + `orders_payload`. If unset, the prefix defaults to the service name. Read + `table` from the response for the resulting resource name. After the + inference table is created, this field cannot be changed. """ @classmethod @@ -69,35 +48,18 @@ class InferenceTableConfigDict(TypedDict, total=False): parent: VariableOr[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Parent UC schema where the inference table is created. - Format: `schemas/{catalog}.{schema}`. Set at create time and immutable - thereafter; changing it on an existing service is rejected. - """ - - disabled: VariableOrOptional[bool] - """ - :meta private: [EXPERIMENTAL] - - [Beta] Indicates whether payload logging is disabled (opt-out). Unset means that - payload logging is active (the on-by-default state coincides with the proto - zero-value, so the server never fills this field for a client that leaves it - unset). Set `disabled = true` to pause runtime logging while keeping the - sub-message attached (preserving `parent` and `table_name_prefix` for a - later flip back to active). `parent` remains required either way. + Parent Unity Catalog schema where the inference table is created, in the + form `schemas/{catalog}.{schema}`. Required when configuring an inference + table. After the inference table is created, this field cannot be changed. """ table_name_prefix: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Prefix for the inference-table's UC-registered name. The actual leaf name UC - stores is `_payload`; the `_payload` suffix is appended - automatically. To find the actual UC table after Create, read the `table` - field on the response. Defaults to `_payload` when unset. - Set at create time and immutable thereafter; changing it on an existing - service is rejected. + Prefix used to form the inference table's registered name. AI Gateway + appends `_payload`; for example, `table_name_prefix = "orders"` creates + `orders_payload`. If unset, the prefix defaults to the service name. Read + `table` from the response for the resulting resource name. After the + inference table is created, this field cannot be changed. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config.py index c2a769a063f..644105ae253 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config.py @@ -58,8 +58,8 @@ @dataclass(kw_only=True) class ModelProviderServiceConfig: """ - Behavioral configuration for a ModelProviderService: provider connection - (auth + provider-specific fields), the catalog of models this provider + Behavioral configuration for a ModelProviderService: provider authentication + and provider-specific fields, the catalog of models this provider service can route to, and the passthrough policy that governs how request headers, query parameters, and unmanaged subpaths cross the trust boundary to the upstream provider. @@ -67,29 +67,23 @@ class ModelProviderServiceConfig: allow_all_targets: VariableOrOptional[bool] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] When true, accepts any model exposed by the upstream provider; `targets` + When true, accepts any model exposed by the upstream provider; `targets` is not required and does not restrict routability. When false, only - models listed in `targets` are routable. + models listed in `targets` are routable. Defaults to false. """ amazon_bedrock: VariableOrOptional[ ModelProviderServiceConfigAmazonBedrockProviderConfig ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Amazon Bedrock provider configuration. + Amazon Bedrock provider configuration. """ anthropic: VariableOrOptional[ModelProviderServiceConfigAnthropicProviderConfig] = ( None ) """ - :meta private: [EXPERIMENTAL] - - [Beta] Anthropic provider configuration. Exactly one of `direct` or `relayed` must + Anthropic provider configuration. Exactly one of `direct` or `relayed` must be set on Create; the two are mutually exclusive. """ @@ -97,120 +91,90 @@ class ModelProviderServiceConfig: ModelProviderServiceConfigAzureOpenAiProviderConfig ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Azure OpenAI provider configuration. + Azure OpenAI provider configuration. """ custom: VariableOrOptional[ModelProviderServiceConfigCustomProviderConfig] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Custom provider configuration: arbitrary HTTP endpoint with bearer-token auth. + Custom OpenAI-compatible provider configuration with bearer-token + authentication. """ forward_headers: VariableOrOptional[bool] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Whether to forward incoming request headers to the upstream provider. - Applies to managed (multi-model) requests as well as passthrough requests - served by this provider service. Governance-level decision by the provider - service owner; not selectable per inference call. + Whether to forward incoming HTTP headers to the upstream provider. Defaults + to false and is configured for the entire provider service, not per request. + Upstream authentication is configured separately in the provider-specific + configuration. """ forward_query_parameters: VariableOrOptional[bool] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Whether to forward incoming request query parameters to the upstream - provider. Same trust-boundary semantics as `forward_headers`. + Whether to forward incoming query parameters to the upstream provider. + Defaults to false and is configured for the entire provider service, not + per request. """ forward_unmanaged_paths: VariableOrOptional[bool] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Whether to forward request paths that fall outside this service's managed - API set to the upstream provider as opaque passthrough. When true, - requests addressed to subpaths not recognized by the managed API surface - are proxied to the upstream provider over the same provider connection. - When false, only managed-API paths are served. Governance-level decision - by the provider service owner; expanding this expands the trust boundary - that the ModelProviderService exposes. + Whether to proxy paths that AI Gateway does not recognize as configured + provider-native API types. Defaults to false. When true, these paths are + forwarded unchanged to the upstream provider. When false, only + recognized API paths are served. Enabling this broadens the upstream API + surface exposed through the provider service. """ gemini_enterprise: VariableOrOptional[ ModelProviderServiceConfigGeminiEnterpriseProviderConfig ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Gemini Enterprise provider configuration. + Gemini Enterprise provider configuration. """ inference_table: VariableOrOptional[InferenceTableConfig] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Inference table configuration for payload logging when this provider - service is invoked directly. When it is invoked through a model service, - the model service's own inference table captures the invocation instead. - Mirrors `ModelServiceConfig.inference_table` / - `AgentServiceConfig.inference_table`. + Payload logging configuration for requests sent directly to this provider + service. Requests routed through a model service are captured by that model + service's inference table instead. """ microsoft_foundry: VariableOrOptional[ ModelProviderServiceConfigMicrosoftFoundryProviderConfig ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Microsoft Foundry provider configuration. + Microsoft Foundry provider configuration. """ openai: VariableOrOptional[ModelProviderServiceConfigOpenAiProviderConfig] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] OpenAI provider configuration. + OpenAI provider configuration. """ provider_type: VariableOrOptional[ ModelProviderServiceConfigExternalModelProviderType ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Provider type discriminator. Required at create time; immutable after. - Determines which variant of the `provider` oneof must be set. May not be - changed via Update; attempts to include `config.provider_type` in - `UpdateModelProviderServiceRequest.update_mask` are rejected. - - Required on CreateModelProviderService and immutable thereafter. + External model provider. Required on Create and immutable thereafter. Set + the matching provider-specific configuration, such as `openai`, + `azure_openai`, or `amazon_bedrock`. """ rate_limits: VariableOrList[RateLimit] = field(default_factory=list) """ - :meta private: [EXPERIMENTAL] - - [Beta] Rate limits applied when this provider service is invoked directly. When - it is invoked through a model service, the model service's own - `rate_limits` apply instead. Mirrors `ModelServiceConfig.rate_limits` / - `McpServiceConfig.rate_limits`. + Rate limits for requests sent directly to this provider service. Requests + routed through a model service use that model service's rate limits instead. """ targets: VariableOrList[ModelProviderServiceConfigModelTargetConfig] = field( default_factory=list ) """ - :meta private: [EXPERIMENTAL] - - [Beta] Routing targets this provider service exposes (provider-side model - identifier + unified API types per entry). Required (>=1) when - `allow_all_targets = false`; optional and additive when - `allow_all_targets = true`. References from `ExternalModelConfig.target` - must match an entry here unless `allow_all_targets = true`. + Models and provider-native API types exposed by this provider service. Each + entry must include at least one `native_api_types` value. When + `allow_all_targets` is false, at least one entry is required and model + service destinations can reference only listed models. When + `allow_all_targets` is true, any upstream model is routable; entries in + this list provide API-type metadata without restricting other models. """ @classmethod @@ -226,29 +190,23 @@ class ModelProviderServiceConfigDict(TypedDict, total=False): allow_all_targets: VariableOrOptional[bool] """ - :meta private: [EXPERIMENTAL] - - [Beta] When true, accepts any model exposed by the upstream provider; `targets` + When true, accepts any model exposed by the upstream provider; `targets` is not required and does not restrict routability. When false, only - models listed in `targets` are routable. + models listed in `targets` are routable. Defaults to false. """ amazon_bedrock: VariableOrOptional[ ModelProviderServiceConfigAmazonBedrockProviderConfigParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Amazon Bedrock provider configuration. + Amazon Bedrock provider configuration. """ anthropic: VariableOrOptional[ ModelProviderServiceConfigAnthropicProviderConfigParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Anthropic provider configuration. Exactly one of `direct` or `relayed` must + Anthropic provider configuration. Exactly one of `direct` or `relayed` must be set on Create; the two are mutually exclusive. """ @@ -256,118 +214,88 @@ class ModelProviderServiceConfigDict(TypedDict, total=False): ModelProviderServiceConfigAzureOpenAiProviderConfigParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Azure OpenAI provider configuration. + Azure OpenAI provider configuration. """ custom: VariableOrOptional[ModelProviderServiceConfigCustomProviderConfigParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] Custom provider configuration: arbitrary HTTP endpoint with bearer-token auth. + Custom OpenAI-compatible provider configuration with bearer-token + authentication. """ forward_headers: VariableOrOptional[bool] """ - :meta private: [EXPERIMENTAL] - - [Beta] Whether to forward incoming request headers to the upstream provider. - Applies to managed (multi-model) requests as well as passthrough requests - served by this provider service. Governance-level decision by the provider - service owner; not selectable per inference call. + Whether to forward incoming HTTP headers to the upstream provider. Defaults + to false and is configured for the entire provider service, not per request. + Upstream authentication is configured separately in the provider-specific + configuration. """ forward_query_parameters: VariableOrOptional[bool] """ - :meta private: [EXPERIMENTAL] - - [Beta] Whether to forward incoming request query parameters to the upstream - provider. Same trust-boundary semantics as `forward_headers`. + Whether to forward incoming query parameters to the upstream provider. + Defaults to false and is configured for the entire provider service, not + per request. """ forward_unmanaged_paths: VariableOrOptional[bool] """ - :meta private: [EXPERIMENTAL] - - [Beta] Whether to forward request paths that fall outside this service's managed - API set to the upstream provider as opaque passthrough. When true, - requests addressed to subpaths not recognized by the managed API surface - are proxied to the upstream provider over the same provider connection. - When false, only managed-API paths are served. Governance-level decision - by the provider service owner; expanding this expands the trust boundary - that the ModelProviderService exposes. + Whether to proxy paths that AI Gateway does not recognize as configured + provider-native API types. Defaults to false. When true, these paths are + forwarded unchanged to the upstream provider. When false, only + recognized API paths are served. Enabling this broadens the upstream API + surface exposed through the provider service. """ gemini_enterprise: VariableOrOptional[ ModelProviderServiceConfigGeminiEnterpriseProviderConfigParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Gemini Enterprise provider configuration. + Gemini Enterprise provider configuration. """ inference_table: VariableOrOptional[InferenceTableConfigParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] Inference table configuration for payload logging when this provider - service is invoked directly. When it is invoked through a model service, - the model service's own inference table captures the invocation instead. - Mirrors `ModelServiceConfig.inference_table` / - `AgentServiceConfig.inference_table`. + Payload logging configuration for requests sent directly to this provider + service. Requests routed through a model service are captured by that model + service's inference table instead. """ microsoft_foundry: VariableOrOptional[ ModelProviderServiceConfigMicrosoftFoundryProviderConfigParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Microsoft Foundry provider configuration. + Microsoft Foundry provider configuration. """ openai: VariableOrOptional[ModelProviderServiceConfigOpenAiProviderConfigParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] OpenAI provider configuration. + OpenAI provider configuration. """ provider_type: VariableOrOptional[ ModelProviderServiceConfigExternalModelProviderTypeParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Provider type discriminator. Required at create time; immutable after. - Determines which variant of the `provider` oneof must be set. May not be - changed via Update; attempts to include `config.provider_type` in - `UpdateModelProviderServiceRequest.update_mask` are rejected. - - Required on CreateModelProviderService and immutable thereafter. + External model provider. Required on Create and immutable thereafter. Set + the matching provider-specific configuration, such as `openai`, + `azure_openai`, or `amazon_bedrock`. """ rate_limits: VariableOrList[RateLimitParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] Rate limits applied when this provider service is invoked directly. When - it is invoked through a model service, the model service's own - `rate_limits` apply instead. Mirrors `ModelServiceConfig.rate_limits` / - `McpServiceConfig.rate_limits`. + Rate limits for requests sent directly to this provider service. Requests + routed through a model service use that model service's rate limits instead. """ targets: VariableOrList[ModelProviderServiceConfigModelTargetConfigParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] Routing targets this provider service exposes (provider-side model - identifier + unified API types per entry). Required (>=1) when - `allow_all_targets = false`; optional and additive when - `allow_all_targets = true`. References from `ExternalModelConfig.target` - must match an entry here unless `allow_all_targets = true`. + Models and provider-native API types exposed by this provider service. Each + entry must include at least one `native_api_types` value. When + `allow_all_targets` is false, at least one entry is required and model + service destinations can reference only listed models. When + `allow_all_targets` is true, any upstream model is routable; entries in + this list provide API-type metadata without restricting other models. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_config.py index f39c7d53c05..cf6015f13c5 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_config.py @@ -25,18 +25,7 @@ class ModelProviderServiceConfigAmazonBedrockProviderConfig: ModelProviderServiceConfigAmazonBedrockProviderDirectConfig ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct form of Amazon Bedrock provider config. - - Authentication is one of two mutually exclusive modes, exactly one of which - must be supplied on Create: - - Access keys: set `aws_access_key`, leave `service_credential` unset. - - UC service credential: set `service_credential.name` to the AIP-122 - resource-name form `credentials/{name}`, leave `aws_access_key` unset. The - credential value lives in UC and is referenced by name, not held on this - message. - Setting more than one mode is rejected. + Amazon Bedrock region and authentication configuration. """ @classmethod @@ -56,18 +45,7 @@ class ModelProviderServiceConfigAmazonBedrockProviderConfigDict(TypedDict, total ModelProviderServiceConfigAmazonBedrockProviderDirectConfigParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct form of Amazon Bedrock provider config. - - Authentication is one of two mutually exclusive modes, exactly one of which - must be supplied on Create: - - Access keys: set `aws_access_key`, leave `service_credential` unset. - - UC service credential: set `service_credential.name` to the AIP-122 - resource-name form `credentials/{name}`, leave `aws_access_key` unset. The - credential value lives in UC and is referenced by name, not held on this - message. - Setting more than one mode is rejected. + Amazon Bedrock region and authentication configuration. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_direct_config.py index 2ff430631d3..911338ad79e 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_direct_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_direct_config.py @@ -27,25 +27,23 @@ class ModelProviderServiceConfigAmazonBedrockProviderDirectConfig: Authentication is one of two mutually exclusive modes, exactly one of which must be supplied on Create: - Access keys: set `aws_access_key`, leave `service_credential` unset. - - UC service credential: set `service_credential.name` to the AIP-122 - resource-name form `credentials/{name}`, leave `aws_access_key` unset. The - credential value lives in UC and is referenced by name, not held on this - message. + - Unity Catalog service credential: set `service_credential.name` to the + resource name `credentials/{name}`, leave `aws_access_key` unset. The + credential value lives in Unity Catalog and is referenced by name, not + held on this message. Setting more than one mode is rejected. """ aws_access_key: VariableOrOptional[ModelProviderServiceConfigAwsAccessKey] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] AWS access-key-pair auth. Mutually exclusive with `service_credential`. + AWS access-key-pair authentication. Set `access_key_id` and + `secret_access_key.plaintext`. Mutually exclusive with + `service_credential`. """ region: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`). + AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`). Required on Create. """ @@ -53,16 +51,12 @@ class ModelProviderServiceConfigAmazonBedrockProviderDirectConfig: ModelProviderServiceConfigServiceCredential ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Reference to a UC service credential authorizing Bedrock requests. On - Create the caller supplies `service_credential.name` in the AIP-122 - resource-name form `credentials/{name}`. Required on Create when using - UC-service-credential auth; mutually exclusive with `aws_access_key`. The - credential is referenced by name; its value is not carried here. On read the - resolved `id` and `is_deleted` are also populated. Only supported on AWS-hosted - workspaces; Create requests from other clouds are rejected with - INVALID_PARAMETER_VALUE. + Reference to a Unity Catalog service credential authorizing Bedrock + requests. On Create, supply `service_credential.name` in the form + `credentials/{name}`. Required on Create when using service-credential + authentication; mutually exclusive with `aws_access_key`. The credential + is referenced by name; its value is not carried here. Only + supported on AWS-hosted workspaces. """ @classmethod @@ -84,16 +78,14 @@ class ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict( aws_access_key: VariableOrOptional[ModelProviderServiceConfigAwsAccessKeyParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] AWS access-key-pair auth. Mutually exclusive with `service_credential`. + AWS access-key-pair authentication. Set `access_key_id` and + `secret_access_key.plaintext`. Mutually exclusive with + `service_credential`. """ region: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`). + AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`). Required on Create. """ @@ -101,16 +93,12 @@ class ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict( ModelProviderServiceConfigServiceCredentialParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Reference to a UC service credential authorizing Bedrock requests. On - Create the caller supplies `service_credential.name` in the AIP-122 - resource-name form `credentials/{name}`. Required on Create when using - UC-service-credential auth; mutually exclusive with `aws_access_key`. The - credential is referenced by name; its value is not carried here. On read the - resolved `id` and `is_deleted` are also populated. Only supported on AWS-hosted - workspaces; Create requests from other clouds are rejected with - INVALID_PARAMETER_VALUE. + Reference to a Unity Catalog service credential authorizing Bedrock + requests. On Create, supply `service_credential.name` in the form + `credentials/{name}`. Required on Create when using service-credential + authentication; mutually exclusive with `aws_access_key`. The credential + is referenced by name; its value is not carried here. Only + supported on AWS-hosted workspaces. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_config.py index 218c4470512..c7b3311ca93 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_config.py @@ -30,22 +30,17 @@ class ModelProviderServiceConfigAnthropicProviderConfig: ModelProviderServiceConfigAnthropicProviderDirectConfig ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct (inline-credentials) form: caller supplies the API key in the - request body. Required on Create unless `relayed` is set. + Direct authentication with an API key supplied in + `direct.api_key.plaintext`. Required unless `relayed` is set. """ relayed: VariableOrOptional[ ModelProviderServiceConfigAnthropicProviderRelayedConfig ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Relayed (credential-less) form: no Anthropic credential is stored. Each - inference request instead carries the caller's own OAuth token, which the - platform forwards to Anthropic on outbound requests. Mutually exclusive - with `direct`; no `api_key` is required or persisted. + Relayed authentication. Each inference request supplies the caller's + OAuth token, which is forwarded to Anthropic. No Anthropic credential is + stored. Mutually exclusive with `direct`. """ @classmethod @@ -65,22 +60,17 @@ class ModelProviderServiceConfigAnthropicProviderConfigDict(TypedDict, total=Fal ModelProviderServiceConfigAnthropicProviderDirectConfigParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct (inline-credentials) form: caller supplies the API key in the - request body. Required on Create unless `relayed` is set. + Direct authentication with an API key supplied in + `direct.api_key.plaintext`. Required unless `relayed` is set. """ relayed: VariableOrOptional[ ModelProviderServiceConfigAnthropicProviderRelayedConfigParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Relayed (credential-less) form: no Anthropic credential is stored. Each - inference request instead carries the caller's own OAuth token, which the - platform forwards to Anthropic on outbound requests. Mutually exclusive - with `direct`; no `api_key` is required or persisted. + Relayed authentication. Each inference request supplies the caller's + OAuth token, which is forwarded to Anthropic. No Anthropic credential is + stored. Mutually exclusive with `direct`. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_direct_config.py index 62815d57c17..d03a79d596d 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_direct_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_direct_config.py @@ -23,11 +23,8 @@ class ModelProviderServiceConfigAnthropicProviderDirectConfig: api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Anthropic API key. Required on Create. Sent as the `x-api-key` header on - outbound requests. Supplied as inline plaintext via - `ProviderSecret.plaintext`. + Anthropic API key. Required when creating the service. Supply the value + in `api_key.plaintext`. """ @classmethod @@ -47,11 +44,8 @@ class ModelProviderServiceConfigAnthropicProviderDirectConfigDict( api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] Anthropic API key. Required on Create. Sent as the `x-api-key` header on - outbound requests. Supplied as inline plaintext via - `ProviderSecret.plaintext`. + Anthropic API key. Required when creating the service. Supply the value + in `api_key.plaintext`. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config.py index ed685584f4a..7754ff58862 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config.py @@ -5,11 +5,6 @@ from databricks.bundles.core._transform import _transform from databricks.bundles.core._transform_to_json import _transform_to_json_value -from databricks.bundles.core._variable import VariableOrOptional -from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_relayed_config_anthropic_relayed_plan_type import ( - ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType, - ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanTypeParam, -) if TYPE_CHECKING: from typing_extensions import Self @@ -18,22 +13,9 @@ @dataclass(kw_only=True) class ModelProviderServiceConfigAnthropicProviderRelayedConfig: """ - Relayed form of Anthropic provider config: no credential is stored. - Authentication is the caller's own OAuth token, forwarded to Anthropic on - outbound requests, so there is no persisted secret. Presence of this variant - is the signal that the provider service uses relayed auth; `plan_type` - further distinguishes which Anthropic subscription tier the token belongs to. - """ - - plan_type: VariableOrOptional[ - ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType - ] = None - """ - :meta private: [EXPERIMENTAL] - - [Beta] Which Anthropic subscription tier the relayed token belongs to. Optional; - when unset the MPS gets the full governance surface (see TEAM_ENTERPRISE). - Immutable after Create, so the tier cannot be flipped in place. + Relayed Anthropic provider configuration. Each inference request supplies + the caller's OAuth token, which is forwarded to Anthropic. No Anthropic + credential is stored. """ @classmethod @@ -51,17 +33,6 @@ class ModelProviderServiceConfigAnthropicProviderRelayedConfigDict( ): """""" - plan_type: VariableOrOptional[ - ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanTypeParam - ] - """ - :meta private: [EXPERIMENTAL] - - [Beta] Which Anthropic subscription tier the relayed token belongs to. Optional; - when unset the MPS gets the full governance surface (see TEAM_ENTERPRISE). - Immutable after Create, so the tier cannot be flipped in place. - """ - ModelProviderServiceConfigAnthropicProviderRelayedConfigParam = ( ModelProviderServiceConfigAnthropicProviderRelayedConfigDict diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config_anthropic_relayed_plan_type.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config_anthropic_relayed_plan_type.py deleted file mode 100644 index d01ffd08cc1..00000000000 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config_anthropic_relayed_plan_type.py +++ /dev/null @@ -1,29 +0,0 @@ -# Code generated by pydabs-codegen. DO NOT EDIT. - -from enum import Enum -from typing import Literal - - -class ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType( - Enum -): - """ - Which Anthropic subscription tier the relayed OAuth token belongs to. - Immutable after Create (switching tiers changes which governance controls - the platform enforces). Only MAX and TEAM_ENTERPRISE differ in the - governance surface the gateway can enforce, not in how the token is - relayed. - """ - - ANTHROPIC_RELAYED_PLAN_TYPE_MAX = "ANTHROPIC_RELAYED_PLAN_TYPE_MAX" - ANTHROPIC_RELAYED_PLAN_TYPE_TEAM_ENTERPRISE = ( - "ANTHROPIC_RELAYED_PLAN_TYPE_TEAM_ENTERPRISE" - ) - - -ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanTypeParam = ( - Literal[ - "ANTHROPIC_RELAYED_PLAN_TYPE_MAX", "ANTHROPIC_RELAYED_PLAN_TYPE_TEAM_ENTERPRISE" - ] - | ModelProviderServiceConfigAnthropicProviderRelayedConfigAnthropicRelayedPlanType -) diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_aws_access_key.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_aws_access_key.py index 2ad6527db4e..6c57b6912d8 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_aws_access_key.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_aws_access_key.py @@ -23,9 +23,7 @@ class ModelProviderServiceConfigAwsAccessKey: access_key_id: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] AWS access key ID. Required on Create when using access-key auth. Treated as + AWS access key ID. Required on Create when using access-key auth. Treated as username-equivalent (not a secret value): round-trips on reads and is scrubbed from audit logs. """ @@ -34,11 +32,9 @@ class ModelProviderServiceConfigAwsAccessKey: None ) """ - :meta private: [EXPERIMENTAL] - - [Beta] AWS secret access key paired with `access_key_id`. Required on Create when - using access-key auth. Supplied as inline plaintext via - `ProviderSecret.plaintext`. + AWS secret access key paired with `access_key_id`. Required when creating + a service with access-key authentication. Supply the value in + `secret_access_key.plaintext`. """ @classmethod @@ -54,20 +50,16 @@ class ModelProviderServiceConfigAwsAccessKeyDict(TypedDict, total=False): access_key_id: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] AWS access key ID. Required on Create when using access-key auth. Treated as + AWS access key ID. Required on Create when using access-key auth. Treated as username-equivalent (not a secret value): round-trips on reads and is scrubbed from audit logs. """ secret_access_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] AWS secret access key paired with `access_key_id`. Required on Create when - using access-key auth. Supplied as inline plaintext via - `ProviderSecret.plaintext`. + AWS secret access key paired with `access_key_id`. Required when creating + a service with access-key authentication. Supply the value in + `secret_access_key.plaintext`. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_config.py index 3e9ae9100ba..60726eeffed 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_config.py @@ -25,20 +25,7 @@ class ModelProviderServiceConfigAzureOpenAiProviderConfig: ModelProviderServiceConfigAzureOpenAiProviderDirectConfig ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct form of Azure OpenAI provider config. Exactly one of three - mutually-exclusive auth modes must be supplied on Create: - - API key: set `api_key`, leave `entra_service_principal` and - `service_credential` unset. - - Entra ID (service principal): set `entra_service_principal`, leave - `api_key` and `service_credential` unset. - - UC service credential: set `service_credential.name` to the AIP-122 - resource-name form `credentials/{name}`, leave `api_key` and - `entra_service_principal` unset. The credential value lives in UC and is - referenced by name, not held on this message. Only supported on - Azure-hosted workspaces. - Setting more than one mode is rejected. + Azure OpenAI endpoint and authentication configuration. """ @classmethod @@ -58,20 +45,7 @@ class ModelProviderServiceConfigAzureOpenAiProviderConfigDict(TypedDict, total=F ModelProviderServiceConfigAzureOpenAiProviderDirectConfigParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct form of Azure OpenAI provider config. Exactly one of three - mutually-exclusive auth modes must be supplied on Create: - - API key: set `api_key`, leave `entra_service_principal` and - `service_credential` unset. - - Entra ID (service principal): set `entra_service_principal`, leave - `api_key` and `service_credential` unset. - - UC service credential: set `service_credential.name` to the AIP-122 - resource-name form `credentials/{name}`, leave `api_key` and - `entra_service_principal` unset. The credential value lives in UC and is - referenced by name, not held on this message. Only supported on - Azure-hosted workspaces. - Setting more than one mode is rejected. + Azure OpenAI endpoint and authentication configuration. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_direct_config.py index e2f56b91507..9ba84e99974 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_direct_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_direct_config.py @@ -32,28 +32,24 @@ class ModelProviderServiceConfigAzureOpenAiProviderDirectConfig: `service_credential` unset. - Entra ID (service principal): set `entra_service_principal`, leave `api_key` and `service_credential` unset. - - UC service credential: set `service_credential.name` to the AIP-122 - resource-name form `credentials/{name}`, leave `api_key` and - `entra_service_principal` unset. The credential value lives in UC and is - referenced by name, not held on this message. Only supported on - Azure-hosted workspaces. + - Unity Catalog service credential: set `service_credential.name` to the + resource name `credentials/{name}`, leave `api_key` and + `entra_service_principal` unset. The credential value lives in Unity + Catalog and is referenced by name, not held on this message. Only + supported on Azure-hosted workspaces. Setting more than one mode is rejected. """ api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Azure OpenAI API key. Mutually exclusive with the Entra and - service-credential modes. Supplied as inline plaintext via - `ProviderSecret.plaintext`. + Azure OpenAI API key. Supply the value in `api_key.plaintext`. Mutually + exclusive with Entra ID and Unity Catalog service credential + authentication. """ base_url: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Full Azure OpenAI endpoint base URL, e.g. + Full Azure OpenAI endpoint base URL, e.g. `https://myresource.openai.azure.com`. Required on Create. """ @@ -61,9 +57,8 @@ class ModelProviderServiceConfigAzureOpenAiProviderDirectConfig: ModelProviderServiceConfigEntraServicePrincipal ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Entra ID (service principal) auth. Mutually exclusive with `api_key` and + Entra ID service-principal authentication. Set `tenant_id`, `client_id`, + and `client_secret.plaintext`. Mutually exclusive with `api_key` and `service_credential`. """ @@ -71,17 +66,12 @@ class ModelProviderServiceConfigAzureOpenAiProviderDirectConfig: ModelProviderServiceConfigServiceCredential ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Reference to a UC service credential authorizing Azure OpenAI requests. On - Create the caller supplies `service_credential.name` in the AIP-122 - resource-name form `credentials/{name}`. Required on Create when using - UC-service-credential auth; mutually exclusive with `api_key` and - `entra_service_principal`. The credential is - referenced by name; its value is not carried here. On read the resolved `id` - and `is_deleted` are also populated. Only supported on Azure-hosted - workspaces; Create requests from other clouds are rejected with - INVALID_PARAMETER_VALUE. + Reference to a Unity Catalog service credential authorizing Azure OpenAI + requests. On Create, supply `service_credential.name` in the form + `credentials/{name}`. Required on Create when using service-credential + authentication; mutually exclusive with `api_key` and + `entra_service_principal`. The credential is referenced by name; its value + is not carried here. Only supported on Azure-hosted workspaces. """ @classmethod @@ -103,18 +93,14 @@ class ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict( api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] Azure OpenAI API key. Mutually exclusive with the Entra and - service-credential modes. Supplied as inline plaintext via - `ProviderSecret.plaintext`. + Azure OpenAI API key. Supply the value in `api_key.plaintext`. Mutually + exclusive with Entra ID and Unity Catalog service credential + authentication. """ base_url: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Full Azure OpenAI endpoint base URL, e.g. + Full Azure OpenAI endpoint base URL, e.g. `https://myresource.openai.azure.com`. Required on Create. """ @@ -122,9 +108,8 @@ class ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict( ModelProviderServiceConfigEntraServicePrincipalParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Entra ID (service principal) auth. Mutually exclusive with `api_key` and + Entra ID service-principal authentication. Set `tenant_id`, `client_id`, + and `client_secret.plaintext`. Mutually exclusive with `api_key` and `service_credential`. """ @@ -132,17 +117,12 @@ class ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict( ModelProviderServiceConfigServiceCredentialParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Reference to a UC service credential authorizing Azure OpenAI requests. On - Create the caller supplies `service_credential.name` in the AIP-122 - resource-name form `credentials/{name}`. Required on Create when using - UC-service-credential auth; mutually exclusive with `api_key` and - `entra_service_principal`. The credential is - referenced by name; its value is not carried here. On read the resolved `id` - and `is_deleted` are also populated. Only supported on Azure-hosted - workspaces; Create requests from other clouds are rejected with - INVALID_PARAMETER_VALUE. + Reference to a Unity Catalog service credential authorizing Azure OpenAI + requests. On Create, supply `service_credential.name` in the form + `credentials/{name}`. Required on Create when using service-credential + authentication; mutually exclusive with `api_key` and + `entra_service_principal`. The credential is referenced by name; its value + is not carried here. Only supported on Azure-hosted workspaces. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_config.py index 1b55ddefd2a..e10c0335481 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_config.py @@ -18,24 +18,15 @@ @dataclass(kw_only=True) class ModelProviderServiceConfigCustomProviderConfig: """ - Custom provider configuration: arbitrary HTTP endpoint with bearer-token auth. + Custom OpenAI-compatible provider configuration with bearer-token + authentication. """ direct: VariableOrOptional[ModelProviderServiceConfigCustomProviderDirectConfig] = ( None ) """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct form of custom provider config. - - Authentication is one of two mutually exclusive modes, exactly one of which - must be supplied on Create: - - Bearer: set `api_key`, leave `header_auth` unset. The secret is - forwarded as `Authorization: Bearer `. - - Header: set `header_auth`, leave `api_key` unset. The secret is - forwarded as `: `. - Setting both modes or neither mode is rejected. + Endpoint and authentication configuration for the custom provider. """ @classmethod @@ -55,17 +46,7 @@ class ModelProviderServiceConfigCustomProviderConfigDict(TypedDict, total=False) ModelProviderServiceConfigCustomProviderDirectConfigParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct form of custom provider config. - - Authentication is one of two mutually exclusive modes, exactly one of which - must be supplied on Create: - - Bearer: set `api_key`, leave `header_auth` unset. The secret is - forwarded as `Authorization: Bearer `. - - Header: set `header_auth`, leave `api_key` unset. The secret is - forwarded as `: `. - Setting both modes or neither mode is rejected. + Endpoint and authentication configuration for the custom provider. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_direct_config.py index bd1289bddf8..3a93a834abd 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_direct_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_direct_config.py @@ -18,31 +18,19 @@ @dataclass(kw_only=True) class ModelProviderServiceConfigCustomProviderDirectConfig: """ - Direct form of custom provider config. - - Authentication is one of two mutually exclusive modes, exactly one of which - must be supplied on Create: - - Bearer: set `api_key`, leave `header_auth` unset. The secret is - forwarded as `Authorization: Bearer `. - - Header: set `header_auth`, leave `api_key` unset. The secret is - forwarded as `: `. - Setting both modes or neither mode is rejected. + Direct form of a custom provider configuration. Set `api_key` to the bearer + token sent in the `Authorization` header. """ api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Bearer token forwarded as the `Authorization: Bearer ...` header on - outbound requests. Supplied as inline plaintext via - `ProviderSecret.plaintext`. Set this for bearer-token auth. + Bearer token forwarded in the `Authorization` header. Supply the value + in `api_key.plaintext`. """ base_url: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Endpoint URL of the OpenAI-compatible service (e.g., + Endpoint URL of the OpenAI-compatible service (e.g., `https://api.example.com/v1`). Required on Create. """ @@ -61,18 +49,13 @@ class ModelProviderServiceConfigCustomProviderDirectConfigDict(TypedDict, total= api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] Bearer token forwarded as the `Authorization: Bearer ...` header on - outbound requests. Supplied as inline plaintext via - `ProviderSecret.plaintext`. Set this for bearer-token auth. + Bearer token forwarded in the `Authorization` header. Supply the value + in `api_key.plaintext`. """ base_url: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Endpoint URL of the OpenAI-compatible service (e.g., + Endpoint URL of the OpenAI-compatible service (e.g., `https://api.example.com/v1`). Required on Create. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_entra_service_principal.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_entra_service_principal.py index 5e4b2ace0a1..cf5fcefd569 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_entra_service_principal.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_entra_service_principal.py @@ -18,33 +18,25 @@ @dataclass(kw_only=True) class ModelProviderServiceConfigEntraServicePrincipal: """ - Entra ID (Azure AD) service-principal auth: AI Gateway exchanges the - `tenant_id` + `client_id` identify the service principal, and the `credential` - oneof proves that identity, exchanged for an Entra bearer token on outbound - requests via the OAuth2 client-credentials grant. Shared by the Azure OpenAI - and Microsoft Foundry provider configs. + Entra ID (Azure AD) service-principal authentication. The `tenant_id` and + `client_id` identify the service principal, and `client_secret` authenticates + it. AI Gateway exchanges these credentials for an Entra bearer token for + requests to Azure OpenAI or Microsoft Foundry. """ client_id: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Entra ID client (application) ID. Required on Create. + Entra ID client (application) ID. Required on Create. """ client_secret: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Entra ID client secret. Supplied as inline plaintext via - `ProviderSecret.plaintext`. + Entra ID client secret. Supply the value in `client_secret.plaintext`. """ tenant_id: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Entra ID (Azure AD) tenant ID. Required on Create. + Entra ID (Azure AD) tenant ID. Required on Create. """ @classmethod @@ -62,24 +54,17 @@ class ModelProviderServiceConfigEntraServicePrincipalDict(TypedDict, total=False client_id: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Entra ID client (application) ID. Required on Create. + Entra ID client (application) ID. Required on Create. """ client_secret: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] Entra ID client secret. Supplied as inline plaintext via - `ProviderSecret.plaintext`. + Entra ID client secret. Supply the value in `client_secret.plaintext`. """ tenant_id: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Entra ID (Azure AD) tenant ID. Required on Create. + Entra ID (Azure AD) tenant ID. Required on Create. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_config.py index a9c8a1aab39..38f005ad002 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_config.py @@ -25,14 +25,7 @@ class ModelProviderServiceConfigGeminiEnterpriseProviderConfig: ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct form of Gemini Enterprise provider config. - - Authentication is one of two mutually exclusive modes; exactly one must be - supplied on Create: - - API key: set `api_key`, leave `service_credential` unset. - - UC service credential: set `service_credential`, leave `api_key` unset. + Gemini Enterprise project, region, and authentication configuration. """ @classmethod @@ -54,14 +47,7 @@ class ModelProviderServiceConfigGeminiEnterpriseProviderConfigDict( ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct form of Gemini Enterprise provider config. - - Authentication is one of two mutually exclusive modes; exactly one must be - supplied on Create: - - API key: set `api_key`, leave `service_credential` unset. - - UC service credential: set `service_credential`, leave `api_key` unset. + Gemini Enterprise project, region, and authentication configuration. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_direct_config.py index 7d1a5d9b9f7..9b35a4cc312 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_direct_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_direct_config.py @@ -18,35 +18,24 @@ @dataclass(kw_only=True) class ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig: """ - Direct form of Gemini Enterprise provider config. - - Authentication is one of two mutually exclusive modes; exactly one must be - supplied on Create: - - API key: set `api_key`, leave `service_credential` unset. - - UC service credential: set `service_credential`, leave `api_key` unset. + Direct Gemini Enterprise provider configuration. An API key is required + when creating the service. """ api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Google Gemini Enterprise API key. Required on Create when using API-key - auth; mutually exclusive with `service_credential`. Supplied as inline - plaintext via `ProviderSecret.plaintext`. + Google Gemini Enterprise API key. Required when creating the service. + Supply the value in `api_key.plaintext`. """ project_id: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] GCP project ID hosting the Gemini Enterprise endpoint. Required on Create. + GCP project ID hosting the Gemini Enterprise endpoint. Required on Create. """ region: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`). + GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`). Required on Create. """ @@ -69,25 +58,18 @@ class ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigDict( api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] Google Gemini Enterprise API key. Required on Create when using API-key - auth; mutually exclusive with `service_credential`. Supplied as inline - plaintext via `ProviderSecret.plaintext`. + Google Gemini Enterprise API key. Required when creating the service. + Supply the value in `api_key.plaintext`. """ project_id: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] GCP project ID hosting the Gemini Enterprise endpoint. Required on Create. + GCP project ID hosting the Gemini Enterprise endpoint. Required on Create. """ region: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`). + GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`). Required on Create. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_config.py index 7f91bf9ac35..c63fe203888 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_config.py @@ -25,24 +25,7 @@ class ModelProviderServiceConfigMicrosoftFoundryProviderConfig: ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct form of Microsoft Foundry provider config. - - Authentication is one of three mutually exclusive modes, exactly one of which - must be supplied on Create: - - API key: set `api_key`, leave `entra_service_principal` and - `service_credential` unset. - - Entra ID (service principal): set `entra_service_principal`, leave - `api_key` and `service_credential` unset. AI Gateway exchanges these for - an Entra bearer token on outbound requests via the OAuth2 - client-credentials grant. - - UC service credential: set `service_credential.name` to the AIP-122 - resource-name form `credentials/{name}`, leave `api_key` and - `entra_service_principal` unset. The credential value lives in UC and is - referenced by name, not held on this message. Only supported on - Azure-hosted workspaces. - Setting more than one mode is rejected. + Microsoft Foundry endpoint and authentication configuration. """ @classmethod @@ -64,24 +47,7 @@ class ModelProviderServiceConfigMicrosoftFoundryProviderConfigDict( ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct form of Microsoft Foundry provider config. - - Authentication is one of three mutually exclusive modes, exactly one of which - must be supplied on Create: - - API key: set `api_key`, leave `entra_service_principal` and - `service_credential` unset. - - Entra ID (service principal): set `entra_service_principal`, leave - `api_key` and `service_credential` unset. AI Gateway exchanges these for - an Entra bearer token on outbound requests via the OAuth2 - client-credentials grant. - - UC service credential: set `service_credential.name` to the AIP-122 - resource-name form `credentials/{name}`, leave `api_key` and - `entra_service_principal` unset. The credential value lives in UC and is - referenced by name, not held on this message. Only supported on - Azure-hosted workspaces. - Setting more than one mode is rejected. + Microsoft Foundry endpoint and authentication configuration. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_direct_config.py index a4627bafd23..5caad765601 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_direct_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_direct_config.py @@ -36,37 +36,32 @@ class ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig: `api_key` and `service_credential` unset. AI Gateway exchanges these for an Entra bearer token on outbound requests via the OAuth2 client-credentials grant. - - UC service credential: set `service_credential.name` to the AIP-122 - resource-name form `credentials/{name}`, leave `api_key` and - `entra_service_principal` unset. The credential value lives in UC and is - referenced by name, not held on this message. Only supported on - Azure-hosted workspaces. + - Unity Catalog service credential: set `service_credential.name` to the + resource name `credentials/{name}`, leave `api_key` and + `entra_service_principal` unset. The credential value lives in Unity + Catalog and is referenced by name, not held on this message. Only + supported on Azure-hosted workspaces. Setting more than one mode is rejected. """ api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Microsoft AI Foundry API key. Mutually exclusive with the Entra and - service-credential modes. Supplied as inline plaintext via - `ProviderSecret.plaintext`. + Microsoft Foundry API key. Supply the value in `api_key.plaintext`. + Mutually exclusive with Entra ID and Unity Catalog service credential + authentication. """ base_url: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Microsoft AI Foundry endpoint URL. Required on Create. + Microsoft Foundry endpoint URL. Required on Create. """ entra_service_principal: VariableOrOptional[ ModelProviderServiceConfigEntraServicePrincipal ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Entra ID (service principal) auth. Mutually exclusive with `api_key` and + Entra ID service-principal authentication. Set `tenant_id`, `client_id`, + and `client_secret.plaintext`. Mutually exclusive with `api_key` and `service_credential`. """ @@ -74,17 +69,12 @@ class ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig: ModelProviderServiceConfigServiceCredential ] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Reference to a UC service credential authorizing Microsoft Foundry requests. - On Create the caller supplies `service_credential.name` in the AIP-122 - resource-name form `credentials/{name}`. Required on Create when using - UC-service-credential auth; mutually exclusive with `api_key` and - `entra_service_principal`. The credential is - referenced by name; its value is not carried here. On read the resolved `id` - and `is_deleted` are also populated. Only supported on Azure-hosted - workspaces; Create requests from other clouds are rejected with - INVALID_PARAMETER_VALUE. + Reference to a Unity Catalog service credential authorizing Microsoft + Foundry requests. On Create, supply `service_credential.name` in the form + `credentials/{name}`. Required on Create when using service-credential + authentication; mutually exclusive with `api_key` and + `entra_service_principal`. The credential is referenced by name; its value + is not carried here. Only supported on Azure-hosted workspaces. """ @classmethod @@ -106,27 +96,22 @@ class ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict( api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] Microsoft AI Foundry API key. Mutually exclusive with the Entra and - service-credential modes. Supplied as inline plaintext via - `ProviderSecret.plaintext`. + Microsoft Foundry API key. Supply the value in `api_key.plaintext`. + Mutually exclusive with Entra ID and Unity Catalog service credential + authentication. """ base_url: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Microsoft AI Foundry endpoint URL. Required on Create. + Microsoft Foundry endpoint URL. Required on Create. """ entra_service_principal: VariableOrOptional[ ModelProviderServiceConfigEntraServicePrincipalParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Entra ID (service principal) auth. Mutually exclusive with `api_key` and + Entra ID service-principal authentication. Set `tenant_id`, `client_id`, + and `client_secret.plaintext`. Mutually exclusive with `api_key` and `service_credential`. """ @@ -134,17 +119,12 @@ class ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict( ModelProviderServiceConfigServiceCredentialParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Reference to a UC service credential authorizing Microsoft Foundry requests. - On Create the caller supplies `service_credential.name` in the AIP-122 - resource-name form `credentials/{name}`. Required on Create when using - UC-service-credential auth; mutually exclusive with `api_key` and - `entra_service_principal`. The credential is - referenced by name; its value is not carried here. On read the resolved `id` - and `is_deleted` are also populated. Only supported on Azure-hosted - workspaces; Create requests from other clouds are rejected with - INVALID_PARAMETER_VALUE. + Reference to a Unity Catalog service credential authorizing Microsoft + Foundry requests. On Create, supply `service_credential.name` in the form + `credentials/{name}`. Required on Create when using service-credential + authentication; mutually exclusive with `api_key` and + `entra_service_principal`. The credential is referenced by name; its value + is not carried here. Only supported on Azure-hosted workspaces. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_model_target_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_model_target_config.py index d2538a33196..9625c038b3e 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_model_target_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_model_target_config.py @@ -19,23 +19,17 @@ class ModelProviderServiceConfigModelTargetConfig: model: VariableOr[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Provider-side model identifier (e.g. "gpt-5", "claude-opus-4-7"). This is - a string on the LLM provider's side, not a UC entity. The UC governance - hook for external destinations is the ModelProviderService referenced by - `ExternalModelConfig.model_provider_service`, not the model itself. + Provider-side model identifier, such as `gpt-5` or `claude-opus-4-7`. + This identifies a model at the upstream provider; it is not a Unity + Catalog model resource. """ native_api_types: VariableOrList[str] = field(default_factory=list) """ - :meta private: [EXPERIMENTAL] - - [Beta] Provider-native API types the model supports (e.g. - "openai/v1/chat/completions"). Used by the platform for request/response - translation from the unified API type. At most 64 entries of at most 256 - characters each; the list is persisted into the destination binding's - bounded storage envelope. + Provider-native API types supported by this model, such as + `openai/v1/chat/completions`. At least one value is required. AI Gateway + uses these values to translate requests and responses. At most 64 entries + of 256 characters each are allowed. """ @classmethod @@ -53,23 +47,17 @@ class ModelProviderServiceConfigModelTargetConfigDict(TypedDict, total=False): model: VariableOr[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Provider-side model identifier (e.g. "gpt-5", "claude-opus-4-7"). This is - a string on the LLM provider's side, not a UC entity. The UC governance - hook for external destinations is the ModelProviderService referenced by - `ExternalModelConfig.model_provider_service`, not the model itself. + Provider-side model identifier, such as `gpt-5` or `claude-opus-4-7`. + This identifies a model at the upstream provider; it is not a Unity + Catalog model resource. """ native_api_types: VariableOrList[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Provider-native API types the model supports (e.g. - "openai/v1/chat/completions"). Used by the platform for request/response - translation from the unified API type. At most 64 entries of at most 256 - characters each; the list is persisted into the destination binding's - bounded storage envelope. + Provider-native API types supported by this model, such as + `openai/v1/chat/completions`. At least one value is required. AI Gateway + uses these values to translate requests and responses. At most 64 entries + of 256 characters each are allowed. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_config.py index 29a88e526b7..70200550381 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_config.py @@ -25,9 +25,7 @@ class ModelProviderServiceConfigOpenAiProviderConfig: None ) """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct (inline-credentials) form of the OpenAI provider config. + OpenAI configuration with an API key supplied in the request. """ @classmethod @@ -47,9 +45,7 @@ class ModelProviderServiceConfigOpenAiProviderConfigDict(TypedDict, total=False) ModelProviderServiceConfigOpenAiProviderDirectConfigParam ] """ - :meta private: [EXPERIMENTAL] - - [Beta] Direct (inline-credentials) form of the OpenAI provider config. + OpenAI configuration with an API key supplied in the request. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_direct_config.py index 5b88a5fd908..128ce50e14e 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_direct_config.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_direct_config.py @@ -23,25 +23,19 @@ class ModelProviderServiceConfigOpenAiProviderDirectConfig: api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] OpenAI API key. Required on Create. Supplied as inline plaintext via - `ProviderSecret.plaintext`. + OpenAI API key. Required when creating the service. Supply the value in + `api_key.plaintext`. """ base_url: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for + Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for OpenAI-API-compatible third-party endpoints or in-network proxies. """ organization: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Optional OpenAI organization ID. When set, the platform forwards it as + Optional OpenAI organization ID. When set, the platform forwards it as the `OpenAI-Organization` header. """ @@ -60,25 +54,19 @@ class ModelProviderServiceConfigOpenAiProviderDirectConfigDict(TypedDict, total= api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] OpenAI API key. Required on Create. Supplied as inline plaintext via - `ProviderSecret.plaintext`. + OpenAI API key. Required when creating the service. Supply the value in + `api_key.plaintext`. """ base_url: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for + Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for OpenAI-API-compatible third-party endpoints or in-network proxies. """ organization: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Optional OpenAI organization ID. When set, the platform forwards it as + Optional OpenAI organization ID. When set, the platform forwards it as the `OpenAI-Organization` header. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_secret.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_secret.py index b903e2351d1..9b36c6ec54f 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_secret.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_secret.py @@ -22,11 +22,9 @@ class ModelProviderServiceConfigProviderSecret: plaintext: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Inline plaintext credential. INPUT_ONLY: the value never round-trips on - reads. Get and List responses omit `plaintext`; the field's presence in - the read shape only indicates that a secret is configured. + Inline plaintext credential. INPUT_ONLY: the value never round-trips on + reads. Get and List responses omit `plaintext`; the enclosing secret + object remains present to indicate that a secret is configured. """ @classmethod @@ -42,11 +40,9 @@ class ModelProviderServiceConfigProviderSecretDict(TypedDict, total=False): plaintext: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Inline plaintext credential. INPUT_ONLY: the value never round-trips on - reads. Get and List responses omit `plaintext`; the field's presence in - the read shape only indicates that a secret is configured. + Inline plaintext credential. INPUT_ONLY: the value never round-trips on + reads. Get and List responses omit `plaintext`; the enclosing secret + object remains present to indicate that a secret is configured. """ diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_service_credential.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_service_credential.py index 543c9efed49..12753ea2865 100644 --- a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_service_credential.py +++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_service_credential.py @@ -14,19 +14,16 @@ @dataclass(kw_only=True) class ModelProviderServiceConfigServiceCredential: """ - ---- Provider configuration (nested; see the `provider` oneof below) ---- - The customer-owned UC service credential a ModelProviderService uses to - authenticate to its provider, referenced by name. + The customer-owned Unity Catalog service credential a model provider service + uses to authenticate to its provider, referenced by name. """ name: VariableOr[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Resource name of the bound UC service credential, in the AIP-122 form - `credentials/{name}` (a metastore-level single-part credential name). On - create the caller supplies the name here. On read it reflects the - credential's current name at read time. + Resource name of the bound Unity Catalog service credential, in the form + `credentials/{name}`. Supply this field when creating the service or + rebinding its credential. On read, it reflects the credential's current + name. """ @classmethod @@ -44,12 +41,10 @@ class ModelProviderServiceConfigServiceCredentialDict(TypedDict, total=False): name: VariableOr[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Resource name of the bound UC service credential, in the AIP-122 form - `credentials/{name}` (a metastore-level single-part credential name). On - create the caller supplies the name here. On read it reflects the - credential's current name at read time. + Resource name of the bound Unity Catalog service credential, in the form + `credentials/{name}`. Supply this field when creating the service or + rebinding its credential. On read, it reflects the credential's current + name. """ diff --git a/python/databricks/bundles/model_provider_services/_models/rate_limit.py b/python/databricks/bundles/model_provider_services/_models/rate_limit.py index 1161810fc32..5bbb533157a 100644 --- a/python/databricks/bundles/model_provider_services/_models/rate_limit.py +++ b/python/databricks/bundles/model_provider_services/_models/rate_limit.py @@ -29,58 +29,32 @@ class RateLimit: key: VariableOr[RateLimitRateLimitKey] """ - :meta private: [EXPERIMENTAL] - - [Beta] Scope key. Determines whether `principal` is required. + Scope of the rate limit. Depending on this value, the limit applies to a + principal, the service as a whole, or each user by default. """ renewal_period: VariableOr[RateLimitRateLimitRenewalPeriod] """ - :meta private: [EXPERIMENTAL] - - [Beta] Renewal period. + Renewal period. """ principal: VariableOrOptional[str] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Principal this limit applies to: user email, group name, or service - principal application ID. Required unless `key` is - `RATE_LIMIT_KEY_SERVICE`, `RATE_LIMIT_KEY_USER_DEFAULT`, or - `RATE_LIMIT_KEY_REQUEST_TAG` (which must not set a principal). - """ - - request_tag_key: VariableOrOptional[str] = None - """ - :meta private: [EXPERIMENTAL] - - [Beta] Request tag key this limit applies to. Required when `key` is - `RATE_LIMIT_KEY_REQUEST_TAG`, forbidden otherwise. - """ - - request_tag_value: VariableOrOptional[str] = None - """ - :meta private: [EXPERIMENTAL] - - [Beta] Request tag value this limit applies to. Only valid when `key` is - `RATE_LIMIT_KEY_REQUEST_TAG`. Leave unset to apply the limit to every - value of `request_tag_key` (an any-value default); a set value is a - specific override for that value. + Principal this limit applies to: user email, group name, or service + principal application ID. Required when `key` applies to a user, group, or + service principal; otherwise it must be unset. """ requests: VariableOrOptional[int] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Max requests allowed within a renewal period. Leave unset for no request limit. + Maximum requests allowed in one renewal period. Leave unset for no request + limit. Set to `0` to deny all requests. """ tokens: VariableOrOptional[int] = None """ - :meta private: [EXPERIMENTAL] - - [Beta] Max tokens allowed within a renewal period. Leave unset for no token limit. + Maximum tokens allowed in one renewal period. Leave unset for no token + limit. Set to `0` to deny all requests. """ @classmethod @@ -96,58 +70,32 @@ class RateLimitDict(TypedDict, total=False): key: VariableOr[RateLimitRateLimitKeyParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] Scope key. Determines whether `principal` is required. + Scope of the rate limit. Depending on this value, the limit applies to a + principal, the service as a whole, or each user by default. """ renewal_period: VariableOr[RateLimitRateLimitRenewalPeriodParam] """ - :meta private: [EXPERIMENTAL] - - [Beta] Renewal period. + Renewal period. """ principal: VariableOrOptional[str] """ - :meta private: [EXPERIMENTAL] - - [Beta] Principal this limit applies to: user email, group name, or service - principal application ID. Required unless `key` is - `RATE_LIMIT_KEY_SERVICE`, `RATE_LIMIT_KEY_USER_DEFAULT`, or - `RATE_LIMIT_KEY_REQUEST_TAG` (which must not set a principal). - """ - - request_tag_key: VariableOrOptional[str] - """ - :meta private: [EXPERIMENTAL] - - [Beta] Request tag key this limit applies to. Required when `key` is - `RATE_LIMIT_KEY_REQUEST_TAG`, forbidden otherwise. - """ - - request_tag_value: VariableOrOptional[str] - """ - :meta private: [EXPERIMENTAL] - - [Beta] Request tag value this limit applies to. Only valid when `key` is - `RATE_LIMIT_KEY_REQUEST_TAG`. Leave unset to apply the limit to every - value of `request_tag_key` (an any-value default); a set value is a - specific override for that value. + Principal this limit applies to: user email, group name, or service + principal application ID. Required when `key` applies to a user, group, or + service principal; otherwise it must be unset. """ requests: VariableOrOptional[int] """ - :meta private: [EXPERIMENTAL] - - [Beta] Max requests allowed within a renewal period. Leave unset for no request limit. + Maximum requests allowed in one renewal period. Leave unset for no request + limit. Set to `0` to deny all requests. """ tokens: VariableOrOptional[int] """ - :meta private: [EXPERIMENTAL] - - [Beta] Max tokens allowed within a renewal period. Leave unset for no token limit. + Maximum tokens allowed in one renewal period. Leave unset for no token + limit. Set to `0` to deny all requests. """ diff --git a/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_key.py b/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_key.py index 0e4c11862a8..fb907da810f 100644 --- a/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_key.py +++ b/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_key.py @@ -14,7 +14,6 @@ class RateLimitRateLimitKey(Enum): RATE_LIMIT_KEY_SERVICE_PRINCIPAL = "RATE_LIMIT_KEY_SERVICE_PRINCIPAL" RATE_LIMIT_KEY_SERVICE = "RATE_LIMIT_KEY_SERVICE" RATE_LIMIT_KEY_USER_DEFAULT = "RATE_LIMIT_KEY_USER_DEFAULT" - RATE_LIMIT_KEY_REQUEST_TAG = "RATE_LIMIT_KEY_REQUEST_TAG" RateLimitRateLimitKeyParam = ( @@ -24,7 +23,6 @@ class RateLimitRateLimitKey(Enum): "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_USER_DEFAULT", - "RATE_LIMIT_KEY_REQUEST_TAG", ] | RateLimitRateLimitKey ) From 26b3fb946939e00fbb85a030d6f86a283eed3313 Mon Sep 17 00:00:00 2001 From: Alex Khakhlyuk Date: Tue, 15 Sep 2026 12:08:33 +0000 Subject: [PATCH 4/5] Move model_provider_services direct-engine config to the per-resource configs/ layout Main #6679 split the monolithic resources.yml / resources.generated.yml into one file per resource under configs/. Recreate the model_provider_services rules in that layout: configs/model_provider_services.yml (provided_id_fields for the immutable parent + model_provider_service_id) and the regenerated configs/model_provider_services.generated.yml (provider_type recreate + the write-only provider-credential and inference_table suppressions, derived from catalog.ModelProviderService via apitypes.yml). No behavior change. Co-authored-by: Isaac --- .../model_provider_services.generated.yml | 30 +++++++++++++++++++ .../configs/model_provider_services.yml | 9 ++++++ 2 files changed, 39 insertions(+) create mode 100644 bundle/direct/dresources/configs/model_provider_services.generated.yml create mode 100644 bundle/direct/dresources/configs/model_provider_services.yml diff --git a/bundle/direct/dresources/configs/model_provider_services.generated.yml b/bundle/direct/dresources/configs/model_provider_services.generated.yml new file mode 100644 index 00000000000..4bb080d9e8f --- /dev/null +++ b/bundle/direct/dresources/configs/model_provider_services.generated.yml @@ -0,0 +1,30 @@ +# Generated, do not edit. + +recreate_on_changes: + - field: config.provider_type + reason: spec:immutable + +ignore_remote_changes: + - field: config.amazon_bedrock.direct.aws_access_key.secret_access_key.plaintext + reason: spec:input_only + - field: config.anthropic.direct.api_key.plaintext + reason: spec:input_only + - field: config.azure_openai.direct.api_key.plaintext + reason: spec:input_only + - field: config.azure_openai.direct.entra_service_principal.client_secret.plaintext + reason: spec:input_only + - field: config.custom.direct.api_key.plaintext + reason: spec:input_only + - field: config.gemini_enterprise.direct.api_key.plaintext + reason: spec:input_only + - field: config.microsoft_foundry.direct.api_key.plaintext + reason: spec:input_only + - field: config.microsoft_foundry.direct.entra_service_principal.client_secret.plaintext + reason: spec:input_only + - field: config.openai.direct.api_key.plaintext + reason: spec:input_only + + - field: config.inference_table.is_deleted + reason: spec:output_only + - field: config.inference_table.table + reason: spec:output_only diff --git a/bundle/direct/dresources/configs/model_provider_services.yml b/bundle/direct/dresources/configs/model_provider_services.yml new file mode 100644 index 00000000000..f83495c340f --- /dev/null +++ b/bundle/direct/dresources/configs/model_provider_services.yml @@ -0,0 +1,9 @@ +provided_id_fields: + # parent + model_provider_service_id compose the server-derived resource + # name (model-provider-services/{catalog}.{schema}.{model_provider_service}), + # which is the ID the resource is fetched by. Both immutable; a local + # change recreates. DoRead reconstructs them from the returned name. + - field: parent + reason: id_field + - field: model_provider_service_id + reason: id_field From 13e7f9ab6bd2305ff2386c7184a37a64609755ff Mon Sep 17 00:00:00 2001 From: Alex Khakhlyuk Date: Tue, 15 Sep 2026 13:36:47 +0000 Subject: [PATCH 5/5] Rename resolveParent -> resolveAiGatewayParent Addresses jannik's review nit on #6633 (deferred as a follow-up): the helper resolves the compound schemas/{catalog}.{schema} parent shared by the AI Gateway securables, so the more specific name makes the signature clear. Renames the definition and all three call sites (model_services, mcp_services, model_provider_services). No behavior change. Co-authored-by: Isaac --- .../mutator/resourcemutator/capture_uc_dependencies.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/bundle/config/mutator/resourcemutator/capture_uc_dependencies.go b/bundle/config/mutator/resourcemutator/capture_uc_dependencies.go index 330754f0018..488e215a2e2 100644 --- a/bundle/config/mutator/resourcemutator/capture_uc_dependencies.go +++ b/bundle/config/mutator/resourcemutator/capture_uc_dependencies.go @@ -101,11 +101,11 @@ func splitUCName(name string, n int) ([]string, bool) { return parts, true } -// resolveParent rewrites a `schemas/{catalog}.{schema}` parent reference so that +// resolveAiGatewayParent rewrites a `schemas/{catalog}.{schema}` parent reference so that // a catalog or schema defined in the same bundle becomes an explicit deploy-time // dependency. AI Gateway securables address their parent schema with this // compound field rather than separate catalog/schema fields. -func resolveParent(b *bundle.Bundle, parent string) string { +func resolveAiGatewayParent(b *bundle.Bundle, parent string) string { rest, ok := strings.CutPrefix(parent, "schemas/") if !ok { return parent @@ -215,19 +215,19 @@ func (m *captureUCDependencies) Apply(ctx context.Context, b *bundle.Bundle) dia if dynvar.ContainsVariableReference(ms.Parent) { continue } - ms.Parent = resolveParent(b, ms.Parent) + ms.Parent = resolveAiGatewayParent(b, ms.Parent) } for _, ms := range b.Config.Resources.McpServices { if ms == nil { continue } - ms.Parent = resolveParent(b, ms.Parent) + ms.Parent = resolveAiGatewayParent(b, ms.Parent) } for _, mps := range b.Config.Resources.ModelProviderServices { if mps == nil { continue } - mps.Parent = resolveParent(b, mps.Parent) + mps.Parent = resolveAiGatewayParent(b, mps.Parent) } // Schemas are resolved last because the schema catalog resolution modifies