> ## Documentation Index > Fetch the complete documentation index at: https://docs.credibledata.com/llms.txt > Use this file to discover all available pages before exploring further. # List environment database connections > Retrieves a list of all database connections configured for the specified environment. Each connection includes its configuration, type, and status information. This endpoint is useful for discovering available data sources within an environment. ## OpenAPI ````yaml /dataplane-public-api-doc.yaml get /environments/{environmentName}/connections openapi: 3.1.0 info: title: Malloy Publisher - Semantic Model Serving API description: > The Malloy Publisher - Semantic Model Serving API provides comprehensive access to Malloy packages and their associated resources. A Malloy package is a directory containing Malloy models (.malloy files), Malloy notebooks (.malloynb files), and embedded databases (.parquet files) with a malloy-publisher.json manifest at the package's root directory. ## Key Features - **Environment Management**: Create and manage environments with their associated packages and connections - **Package Lifecycle**: Full CRUD operations for Malloy packages and their versions - **Model & Notebook Access**: Retrieve and execute Malloy models and notebooks - **Connection Management**: Secure database connection configuration and testing - **Query Execution**: Execute queries against models and retrieve results - **Watch Mode**: Real-time file watching for development workflows ## Resource Hierarchy The API follows a hierarchical resource structure: ``` Environments ├── Connections └── Packages ├── Models ├── Notebooks └── Databases ``` For examples, see the Malloy samples packages (https://github.com/malloydata/malloy-samples) repository. version: v0 servers: - url: https://{organization}.data.credibledata.com/api/v0/ description: Production API server variables: organization: default: demo description: Your organization subdomain security: - bearerAuth: [] tags: - name: publisher description: Publisher status and health check operations - name: environments description: >- Environment lifecycle management including creation, configuration, and deletion of data modeling environments - name: connections description: >- Database connection management for secure data source configuration and access - name: packages description: >- Package management for Malloy data models, including versioning and distribution - name: models description: Malloy model access and compilation operations - name: notebooks description: Malloy notebook access and execution operations - name: pages description: Static HTML pages (in-package data apps) - name: databases description: Embedded database management and access - name: watch-mode description: Real-time file watching for development workflows - name: materializations description: Package-level materializations for persisting Malloy sources paths: /environments/{environmentName}/connections: get: tags: - connections summary: List environment database connections description: > Retrieves a list of all database connections configured for the specified environment. Each connection includes its configuration, type, and status information. This endpoint is useful for discovering available data sources within an environment. operationId: list-connections parameters: - name: environmentName in: path description: Name of the environment required: true schema: $ref: '#/components/schemas/IdentifierPattern' responses: '200': description: A list of database connections in the environment content: application/json: schema: type: array items: $ref: '#/components/schemas/Connection' '401': $ref: '#/components/responses/Unauthorized' '500': $ref: '#/components/responses/InternalServerError' '503': $ref: '#/components/responses/ServiceUnavailable' components: schemas: IdentifierPattern: type: string pattern: ^[a-zA-Z0-9_-]+$ description: Standard identifier pattern for resource names Connection: type: object description: Database connection configuration and metadata properties: resource: type: string description: Resource path to the connection name: type: string description: Name of the connection type: type: string description: Type of database connection enum: - postgres - bigquery - snowflake - trino - databricks - mysql - duckdb - motherduck - ducklake - publisher fingerprint: type: string description: > Optional, opaque, stable fingerprint of this connection's data identity. It is a hash of the configuration that determines *which data* the connection reaches (its data-locating settings), and deliberately excludes credentials and other secret values, so it stays constant across credential rotation and changes only when the connection is pointed at different data. When present, it is used as this connection's contribution to content-addressed build identifiers so that builds re-address only when the underlying data identity actually changes; consumers should treat it as an opaque token and use the supplied value verbatim rather than deriving their own. This field is optional — when omitted, a connection identity is derived locally instead. attributes: $ref: '#/components/schemas/ConnectionAttributes' proxy: $ref: '#/components/schemas/ConnectionProxy' postgresConnection: $ref: '#/components/schemas/PostgresConnection' bigqueryConnection: $ref: '#/components/schemas/BigqueryConnection' snowflakeConnection: $ref: '#/components/schemas/SnowflakeConnection' trinoConnection: $ref: '#/components/schemas/TrinoConnection' databricksConnection: $ref: '#/components/schemas/DatabricksConnection' mysqlConnection: $ref: '#/components/schemas/MysqlConnection' duckdbConnection: $ref: '#/components/schemas/DuckdbConnection' motherduckConnection: $ref: '#/components/schemas/MotherDuckConnection' ducklakeConnection: $ref: '#/components/schemas/DucklakeConnection' publisherConnection: $ref: '#/components/schemas/PublisherConnection' ConnectionAttributes: type: object description: Connection capabilities and configuration attributes properties: dialectName: type: string description: SQL dialect name for the connection isPool: type: boolean description: Whether the connection uses connection pooling canPersist: type: boolean description: Whether the connection supports persistent storage operations canStream: type: boolean description: Whether the connection supports streaming query results ConnectionProxy: type: object description: >- Optional network proxy through which the connection is reached. Applies to any connection type whose database is not directly reachable (e.g. behind a bastion). The proxy is established below the driver, so the driver connects to a local endpoint transparently. Modeled as a discriminated union on `type` so additional proxy mechanisms can be added later. properties: type: type: string description: Proxy mechanism. Currently only SSH local port-forwarding. enum: - ssh ssh: $ref: '#/components/schemas/SshProxyConfig' PostgresConnection: type: object description: PostgreSQL database connection configuration properties: host: type: string description: PostgreSQL server hostname or IP address port: type: integer description: PostgreSQL server port number databaseName: type: string description: Name of the PostgreSQL database userName: type: string description: PostgreSQL username for authentication password: type: string description: PostgreSQL password for authentication connectionString: type: string description: >- Complete PostgreSQL connection string (alternative to individual parameters) sslmode: type: string enum: - disable - no-verify - verify-ca description: >- TLS mode for a connection reached through a `proxy` (SSH bastion). Because the driver connects to a local tunnel endpoint, the cert hostname can't be checked; `verify-ca` validates the server cert chain against the trusted CA bundle (e.g. the baked Amazon RDS roots) without the hostname, `no-verify` encrypts without verifying, and `disable` uses no TLS. The server defaults it to `no-verify` when a proxy is set (so a force-SSL target isn't rejected for plaintext) — a server-applied default, not a schema default. Only valid on a proxied connection — a direct connection uses the deployment PGSSLMODE and rejects this field. BigqueryConnection: type: object description: Google BigQuery database connection configuration properties: defaultProjectId: type: string description: Default BigQuery project ID for queries billingProjectId: type: string description: BigQuery project ID for billing purposes location: type: string description: BigQuery dataset location/region serviceAccountKeyJson: type: string description: JSON string containing Google Cloud service account credentials maximumBytesBilled: type: string description: Maximum bytes to bill for query execution (prevents runaway costs) queryTimeoutMilliseconds: type: string description: Query timeout in milliseconds SnowflakeConnection: type: object description: Snowflake database connection configuration properties: account: type: string description: Snowflake account identifier username: type: string description: Snowflake username for authentication password: type: string description: Snowflake password for authentication privateKey: type: string description: Snowflake private key for authentication privateKeyPass: type: string description: Passphrase for the Snowflake private key warehouse: type: string description: Snowflake warehouse name database: type: string description: Snowflake database name schema: type: string description: Snowflake schema name role: type: string description: Snowflake role name responseTimeoutMilliseconds: type: integer description: Query response timeout in milliseconds TrinoConnection: type: object description: Trino database connection configuration properties: server: type: string description: Trino server hostname or IP address port: type: number description: Trino server port number catalog: type: string description: Trino catalog name schema: type: string description: Trino schema name user: type: string description: Trino username for authentication password: type: string description: Trino password for authentication peakaKey: type: string description: Peaka API key for authentication with Peaka-hosted Trino clusters DatabricksConnection: type: object description: Databricks SQL warehouse connection configuration properties: host: type: string description: >- Databricks workspace host (e.g. dbc-xxxxxxxx-xxxx.cloud.databricks.com) path: type: string description: SQL warehouse HTTP path (e.g. /sql/1.0/warehouses/) token: type: string description: Personal access token for authentication oauthClientId: type: string description: OAuth M2M client ID (service principal) oauthClientSecret: type: string description: OAuth M2M client secret (service principal) defaultCatalog: type: string description: Default Unity Catalog to use for queries defaultSchema: type: string description: Default schema to use for queries setupSQL: type: string description: SQL statements to run when the connection is established MysqlConnection: type: object description: MySQL database connection configuration properties: host: type: string description: MySQL server hostname or IP address port: type: integer description: MySQL server port number database: type: string description: Name of the MySQL database user: type: string description: MySQL username for authentication password: type: string description: MySQL password for authentication DuckdbConnection: type: object description: > DuckDB database connection configuration. Publisher intentionally exposes only data-source intent here. Database files, working directories, filesystem/network policy, extension loading, setup SQL, temp directories, and resource knobs are owned by Publisher so environment configs cannot widen deployment policy through low-level DuckDB settings. properties: attachedDatabases: type: array items: $ref: '#/components/schemas/AttachedDatabase' MotherDuckConnection: type: object description: MotherDuck database connection configuration properties: accessToken: type: string description: MotherDuck access token database: type: string description: MotherDuck database name DucklakeConnection: type: object description: DuckLake lakehouse connection configuration properties: storage: type: object description: Data storage connection configuration (S3 or GCS) properties: bucketUrl: type: string description: >- URL of the storage bucket (e.g. s3://my-bucket/path or gs://my-bucket/path) s3Connection: $ref: '#/components/schemas/S3Connection' description: AWS S3 connection configuration for data storage gcsConnection: $ref: '#/components/schemas/GCSConnection' description: Google Cloud Storage connection configuration for data storage required: - bucketUrl catalog: type: object description: Catalog metadata connection configuration properties: postgresConnection: $ref: '#/components/schemas/PostgresConnection' description: PostgreSQL connection for DuckLake metadata catalog required: - postgresConnection required: - storage - catalog PublisherConnection: type: object description: > Malloy Publisher proxy connection. Proxies SQL to a remote Publisher dataplane instead of connecting to a warehouse directly. The remote dataplane owns authentication, access control, and read-only enforcement. properties: connectionUri: type: string description: > Full URI of the remote connection, e.g. https://org.data.example.com/api/v0/environments//connections/ accessToken: type: string description: Bearer token for the remote dataplane (user-scoped, short-lived) required: - connectionUri Error: type: object description: Standard error response format properties: message: type: string description: Human-readable error message describing what went wrong details: type: string description: Additional error details or context required: - message SshProxyConfig: type: object description: >- SSH bastion / jump-host config for reaching a database inside a private network via an SSH local port-forward. Authentication is public-key only. properties: host: type: string description: Bastion hostname or IP address (the SSH jump host) port: type: integer default: 22 description: Bastion SSH port (defaults to 22) username: type: string description: SSH username on the bastion privateKey: type: string description: >- PEM-encoded SSH private key used to authenticate to the bastion. Write-only secret (never returned by reads). When updating an existing proxy, leave this blank to keep the stored key. The customer authorizes the matching public key in the bastion's authorized_keys. privateKeyPass: type: string description: >- Passphrase for the encrypted private key, if any. Write-only secret (never returned by reads). When updating, leave blank to keep the stored passphrase (kept only when the private key is also kept, not on rotation). hostKey: type: string description: > Optional pinned bastion host public key(s), as one or more OpenSSH known_hosts lines (or bare base64 blobs), verified on every connect. List multiple lines to pin a load-balanced/HA bastion that presents a different key per backend — any listed key is accepted; a mismatch fails the connection closed. Plain and hashed (`|1|…`) lines both work — only the key blob is compared, never the hostname. When omitted, the tunnel connects without host-key verification (the self-service default); the SSH transport is still encrypted. AttachedDatabase: type: object description: Attached DuckDB database properties: name: type: string pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$ example: test_connection, _connection, test_connection_1 type: type: string description: Type of database connection enum: - bigquery - snowflake - postgres - gcs - s3 - azure attributes: $ref: '#/components/schemas/ConnectionAttributes' bigqueryConnection: $ref: '#/components/schemas/BigqueryConnection' snowflakeConnection: $ref: '#/components/schemas/SnowflakeConnection' postgresConnection: $ref: '#/components/schemas/PostgresConnection' gcsConnection: $ref: '#/components/schemas/GCSConnection' s3Connection: $ref: '#/components/schemas/S3Connection' azureConnection: $ref: '#/components/schemas/AzureConnection' S3Connection: type: object description: AWS S3 connection configuration for DuckDB properties: accessKeyId: type: string description: AWS access key ID secretAccessKey: type: string description: AWS secret access key region: type: string description: AWS region (e.g., us-east-1) default: us-east-1 endpoint: type: string description: Custom S3-compatible endpoint URL (optional, for MinIO, etc.) sessionToken: type: string description: AWS session token for temporary credentials (optional) required: - accessKeyId - secretAccessKey GCSConnection: type: object description: Google Cloud Storage connection configuration for DuckDB properties: keyId: type: string description: GCS HMAC access key ID secret: type: string description: GCS HMAC secret key required: - keyId - secret AzureConnection: type: object description: > Azure Data Lake Storage (ADLS Gen2) / Blob Storage connection configuration Supports https://, http://, abfss://, and az:// URL schemes. properties: authType: type: string enum: - service_principal - sas_token description: Authentication method for Azure Storage sasUrl: type: string description: > Full SAS URL including token; required for sas_token auth. Supports single file, directory glob (*.ext), or recursive (**) patterns. Example: https://account.blob.core.windows.net/container/path/*.parquet?sp=rl&st=... tenantId: type: string description: Azure AD tenant ID (required for service_principal) clientId: type: string description: Azure AD application (client) ID (required for service_principal) clientSecret: type: string description: Azure AD client secret (required for service_principal) accountName: type: string description: Azure Storage account name (required for service_principal) fileUrl: type: string description: > Azure file URL to query; required for service_principal auth. Supports single file, directory glob (*.ext), or recursive (**) patterns. Example: https://account.blob.core.windows.net/container/path/** required: - authType responses: Unauthorized: description: Unauthorized - authentication required content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: The server encountered an internal error content: application/json: schema: $ref: '#/components/schemas/Error' ServiceUnavailable: description: > The service is temporarily unable to accept the request. Possible causes: * Initialization or draining state (rolling updates, graceful shutdown). * Memory back-pressure — the publisher's RSS crossed the high-water mark derived from PUBLISHER_MAX_MEMORY_BYTES and PUBLISHER_MEMORY_HIGH_WATER_FRACTION, so new queries are rejected until RSS drops below the low-water mark (PUBLISHER_MEMORY_LOW_WATER_FRACTION). * Per-pod query concurrency cap reached — PUBLISHER_MAX_CONCURRENT_QUERIES in-flight queries are already running on this pod. Clients should retry with backoff; under sustained pressure, scale out, raise PUBLISHER_MAX_MEMORY_BYTES / PUBLISHER_MAX_CONCURRENT_QUERIES, or refine the offending queries. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT ````