> ## Documentation Index > Fetch the complete documentation index at: https://docs.envzero.com/llms.txt > Use this file to discover all available pages before exploring further. # Get a Cloud Compass credential with its features and syncs > Returns the 3 features, the status and last run of each of the 4 syncs, read from CloudQuery on each call. While an edit is open, each call reads its tests and returns it as pendingEdit; once every test passed, the call applies the edit to the same 4 syncs and the credential. ## OpenAPI ````yaml /api-reference/openapi.yml get /cloud-compass/credentials/{id} openapi: 3.1.0 info: title: env zero API description: > This document describes the resources that make up the official env zero REST API ### BaseURL https://api.env0.com/ ### Content Types All requests should be in JSON format, and include the `accept: application/json` header version: 1.0.0 x-logo: url: https://github.com/env0/api/raw/gh-pages/env0-color.png altText: env zero logo servers: - url: https://api.env0.com security: - env0_API_Key: [] tags: - name: Users description: | This API covers management for user settings - name: Agents Settings description: '' - name: Audit Events description: '' - name: Templates description: > A template in env zero defines a type of environment that can be deployed. Click Run Now on a template to create a new environment. A template consists of a name, a description, a valid set of configuration files describing the deployment, and a set of Variables and Secrets. More on https://docs.envzero.com/docs/templates - name: Modules description: Module Registry endpoints - name: Custom Flow description: Project Custom Flow endpoints - name: Approval Policy description: Approval Policy endpoints - name: Bulk Operations description: | Bulk Operations - name: Cloud Compass description: '' - name: Code-Optimizer (BETA) description: > ⚠️ **BETA NOTICE**: All Code-Optimizer APIs are currently in beta and subject to breaking changes. Manages security and code quality issues found when repositories are scanned using code analysis tools. - name: Configuration description: > This API covers all deployment Configuration including: Variables, Tokens, SSH Keys and Deployment Credentials - name: Cost description: > With cost monitoring enabled in env zero, you will be able to see how much each Environment you are running costs. More on https://docs.envzero.com/docs/cost-monitoring - name: Credentials description: > Authentication against the env zero API is done via API Keys. An API Key is created by an organization administrator, but is not connected to any specific user when it's being used. More on https://docs.envzero.com/reference/authentication - name: Dashboard description: | This API covers all dashboard queries - name: Deployment Logs description: | env zero deployment consists of steps such as Init Variables using this API you can retrieve information about those steps - name: Deployment Logs description: The Deployment Logs Endpoint by steps - name: Drift description: | API for reading drift causes detected across an organization. - name: Environment Import description: > Discover and import your existing environments into env zero and track their status - name: Environment Outputs description: | control environments state access configurations - name: Environments description: | An environment is an entity representing a deployment managed by env zero. Your users manage their environments in env zero in Projects. They can create, destroy, and redeploy environments. More on https://docs.envzero.com/docs/environments - name: Modules description: '' - name: Notifications description: > env zero can send notifications for deployment events to your Slack or Microsoft Teams workspace. You can define several Notification Targets, corresponding to different channels. You can also associate these Notification Targets to different env zero projects, controlling which events go to which channel. More on https://docs.envzero.com/docs/notifications - name: Organization description: > An Organization is the highest level logical entity in env zero. All Projects, Templates, Variable, Policies, and Environments, are defined for a specific organization. Organizations are logically separate from each other, and do not share any entities. More on https://docs.envzero.com/docs/organizations - name: Projects description: > Projects are used in env zero to provide granular access control to Environments. Every environment in env zero exists under a project, and users are given access on a per-project basis. Projects are also useful for managing multiple cloud accounts within a single Organization. We recommend using projects to separate dev environments from production environments, each with its own access rights and policies. More on https://docs.envzero.com/docs/projects - name: Provider Registry description: >- Provider Registry allows you to store, version control and share your Terraform providers privately across your organization. More on https://docs.envzero.com/docs/providers - name: Registry Metrics description: | Usage information about the modules your environments use. - name: Modules description: Module Registry endpoints - name: Remote Backend description: | control remote access to remote terraform state - name: Roles description: | Roles are used to get a precise control over who can do what. - name: Scheduling description: > Scheduling allows you to automatically trigger destroys and deploys of your environments on a scheduled basis. Scheduling is configured based on cron expressions, and can be attached to an already deployed environment only. More on https://docs.envzero.com/docs/scheduling - name: Teams description: > Teams allow you to more easily manage your project level permissions in env zero by setting the role for an entire group of users as a single entity. A team belongs to a single Organization, are managed at the Organization Settings level, and are not shared between multiple organizations More on https://docs.envzero.com/docs/teams - name: VCS description: > Manage Self Hosted VCS connections (GitLab Enterprise , GitHub Enterprise, Bitbucket Server) - name: Role Based Access description: > In order to have access to a project, users need to be associated with it. Each user associated with a project has a specific project Role assigned to them. More on https://docs.envzero.com/docs/user-management#manage-users-of-a-project paths: /cloud-compass/credentials/{id}: get: tags: - Configuration summary: Get a Cloud Compass credential with its features and syncs description: >- Returns the 3 features, the status and last run of each of the 4 syncs, read from CloudQuery on each call. While an edit is open, each call reads its tests and returns it as pendingEdit; once every test passed, the call applies the edit to the same 4 syncs and the credential. operationId: configuration-get-cloud-compass-credential parameters: - name: id in: path description: '' required: true schema: type: string - name: organizationId in: query description: '' required: true allowEmptyValue: false schema: type: string responses: '200': description: '' content: application/json: schema: $ref: >- #/components/schemas/ConfigurationApi.GetCloudCompassCredential.Response components: schemas: ConfigurationApi.GetCloudCompassCredential.Response: $ref: '#/components/schemas/CloudCompassCredentialDetails' CloudCompassCredentialDetails: type: object additionalProperties: false properties: includeCostData: type: boolean description: >- False: the credential has no cost sync, and `features` has no cost_and_usage. features: type: array items: $ref: '#/components/schemas/CloudCompassFeatureDetails' settings: $ref: '#/components/schemas/CloudCompassCredentialSettings' description: Absent while a create has not written the credential yet. pendingEdit: $ref: '#/components/schemas/CloudCompassPendingEdit' description: >- The last edit, until it reaches the syncs. A failed edit stays until the next edit. credentialId: type: string name: type: string scope: $ref: '#/components/schemas/CloudCompassScope' status: $ref: '#/components/schemas/CloudCompassCredentialStatus' lastSyncedAt: type: string description: >- The latest completed run among the 5 newest runs of each sync. Absent when none of them completed. draftId: type: string description: >- Set on a `setup_not_finished` credential while its draft exists: Retry sends it to POST cloud-compass/credentials. required: - credentialId - features - includeCostData - name - scope - status CloudCompassFeatureDetails: type: object properties: feature: $ref: '#/components/schemas/CloudCompassFeature' status: $ref: '#/components/schemas/CloudCompassSyncStatus' description: The worst status of the feature's syncs. syncs: type: array items: $ref: '#/components/schemas/CloudCompassSyncDetails' required: - feature - status - syncs additionalProperties: false CloudCompassCredentialSettings: type: object properties: signInMethod: $ref: '#/components/schemas/CloudCompassSignInMethod' roleArn: type: string description: >- The role ARN, or the management account role ARN in Organization mode. organizationUnitIds: type: array items: $ref: '#/components/schemas/AwsOrganizationalUnitId' description: Organization mode only. Empty means the whole Organization. skipAccountIds: type: array items: $ref: '#/components/schemas/AwsAccountId' description: Organization mode only. required: - signInMethod - roleArn additionalProperties: false description: What the credential reads AWS with. The External ID is not returned. CloudCompassPendingEdit: type: object properties: status: type: string enum: - testing - applying - failed roleArn: type: string description: Set when the edit changes the role ARN. externalIdChanged: type: boolean description: True when the edit changes the External ID. organizationUnitIds: type: array items: $ref: '#/components/schemas/AwsOrganizationalUnitId' description: Set when the edit changes the OUs. skipAccountIds: type: array items: $ref: '#/components/schemas/AwsAccountId' description: Set when the edit changes the skipped accounts. testResults: type: array items: $ref: '#/components/schemas/CloudCompassTestResult' description: The CloudQuery test connection result per feature. failureReason: $ref: '#/components/schemas/CloudCompassEditFailureReason' startedAt: type: string format: date-time required: - status - startedAt additionalProperties: false description: >- An edit the syncs do not have yet. `testing`: CloudQuery tests the new settings. `applying`: env0 updates the same 4 syncs and the credential. `failed`: a test failed or timed out and nothing changed, or the apply kept failing. Each read of the credential moves an open edit on, so it waits while nobody reads it. CloudCompassScope: type: object properties: accountMode: type: string enum: - single - organization awsAccountId: type: string awsOrganizationId: type: string accountCount: type: number description: Organization mode only, once env0 knows how many accounts it reads. required: - accountMode additionalProperties: false CloudCompassCredentialStatus: type: string enum: - syncing - synced - partial - disconnected - setup_not_finished - unknown description: >- `setup_not_finished` is a create that stopped before the credential was ready. `unknown` means CloudQuery did not answer, so env0 cannot tell. CloudCompassFeature: type: string enum: - asset_inventory - additional_metadata - cost_and_usage CloudCompassSyncStatus: type: string enum: - syncing - synced - partial - cancelled - disabled - failed - missing - unknown description: >- `missing` means CloudQuery has no such sync; `disabled` means someone turned it off in CloudQuery. CloudCompassSyncDetails: type: object properties: sync: $ref: '#/components/schemas/CloudCompassSyncKey' syncName: type: string status: $ref: '#/components/schemas/CloudCompassSyncStatus' lastRun: $ref: '#/components/schemas/CloudCompassSyncRunDto' description: >- The run the status comes from: the newest finished run, or the newest run before any finished. required: - sync - syncName - status additionalProperties: false CloudCompassSignInMethod: $ref: '#/components/schemas/CloudQueryApi.CloudCompassSignInMethod' description: >- How CloudQuery signs in to the read role. A draft or credential from before OIDC (ATL-606) has none: `assume_role`. AwsOrganizationalUnitId: type: string pattern: ^(ou-[0-9a-z]{4,32}-[a-z0-9]{8,32}|r-[0-9a-z]{4,32})$ AwsAccountId: type: string pattern: ^\d{12}$ CloudCompassTestResult: type: object properties: feature: $ref: '#/components/schemas/CloudCompassFeature' status: type: string enum: - created - started - completed - failed failureReason: type: string failureCode: type: string required: - feature - status additionalProperties: false CloudCompassEditFailureReason: type: string enum: - test_connection_failed - test_connection_timeout - apply_failed description: >- `apply_failed`: env0 could not update the syncs after the tests passed; some syncs may have the new settings. CloudCompassSyncKey: type: string enum: - asset-inventory - cloudtrail - metadata - cost-and-usage description: >- The sync name is `-`. Asset inventory has 2 syncs: asset-inventory and cloudtrail. CloudCompassSyncRunDto: type: object properties: status: type: string enum: - completed - failed - started - cancelled - created - pending statusReason: type: string enum: - error - oom_killed - partial_success - ingestion_failed createdAt: type: string completedAt: type: string totalRows: type: number warnings: type: number errors: type: number required: - status - createdAt - totalRows - warnings - errors additionalProperties: false CloudQueryApi.CloudCompassSignInMethod: type: string enum: - assume_role - oidc description: >- How CloudQuery signs in to the read role. Absent means `assume_role`, as before ATL-606. securitySchemes: env0_API_Key: type: http scheme: basic description: > env zero API authentication is done via API keys. An API Key can either be created by an organization administrator, in which case it will not be connected to any specific user, or via Personal API Keys to authenticate as a user. ### Creating an API Key with a Specific Role * Once you've created your organization, you can set up and manage API Keys. * Navigate to the Organization Settings page and click the API Keys tab. * Click Add API Key and enter a name for your key in the Name field. This name is for reference purposes only and isn't used directly in authentication. > ❗️Save Your API Key ID and secret > The secret will not be available after you close this window. ### Creating a Personal API Key * Click on your avatar (located on the top right of the screen) * Click on Personal Settings * Select the API Keys tab * Click Add API Key, and enter a name for your key in the Name field. This name is for reference purposes and isn't used directly in authentication. > ❗️Save your API Key ID & secret > The secret will not be available after you close this window. ### Using an API Key to Authenticate Authentication of the env zero API is done using the Basic Authentication method. Each request made should include the API Key ID as the username, and the API Key secret as the password. For example, when using curl, we can include these parameters via flag `--user {API Key ID}:{API Key Secret}`. ### API Key Permissions When creating an API key through the organization settings, you will need to choose if you’d like to grant it Organization Admin or User permissions. In case of the latter, you can assign fine-grained permissions per project. Personal API Keys can be created through the user’s profile page and will have the same permissions as the user has. ### Rate Limits env zero API allows up to 1K requests per 60 seconds, requests are aggregated by IP, HTTP Method and URI. If you exceed this limit, you will receive a `429` status code. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.