Authentication

Choose and send the right credential for automating e6data - service tokens with least-privilege permissions.

Every request carries a token in the Authorization header. Pick the credential that fits the caller.

Credential	Best for	How to get it
Service Tokens (recommended for apps and CI)	Unattended apps and pipelines with their own identity and role	Create a service tokens from control plane under Access Control

How to send it - it work as a Bearer token, and are also accepted via X-API-Key. A Bearer token always takes precedence over a browser session cookie.

# service token usage:
curl -H "Authorization: Bearer e6sa_…" https://<HOST>/api/v1/queryservices

Permissions

Access is governed by role-based permissions on each resource. A 403 response names the permission the call needs, so you can grant least privilege.

Resource	Actions
Clusters (query_engine.clusters)	read, create, update (covers suspend / resume / scale), delete
Catalogs (query_engine.catalog)	read, create, update, delete, refresh
Query history (query_engine.history)	read
System catalog (query_engine.system_catalog)	read, execute

The built-in roles - Admin, Manager, and Viewer - cover common cases; create custom roles for tighter scoping. Grant a service token the minimum it needs.

Security

• A raw token is shown exactly once - store it in a secret manager at creation.
• Use one credential per consumer; set an expiry and rotate before it lapses.
• Never log the secret (log the token ID instead) and never commit it.