Managed identities

Managed identities offer significant advantages for high performance computing (HPC) environments by enabling granular access control for individual workspace users. Unlike traditional SSH credentials that grant all workspace users access to HPC clusters using the same set of credentials, managed identities ensure each user’s activity is logged under their own credentials.

Path and query parameters

Name	Type	Location	Req/Opt	Description
orgId	integer	query	Optional	Organization identifier. Append to list managed identities within an organization other than the requester's default.
search	string	query	Optional	Filter search parameter. Supports free text search on name and keywords: platform:.
max	integer	query	Optional	Maximum number of results to return. Default: 20.
offset	integer	query	Optional	Number of results to skip for pagination. Default: 0.
managedIdentityId	integer	path	Required	Managed identity identifier.
checked	boolean	query	Optional	If true, deletion is blocked if running jobs depend on associated managed credentials. Default: false.
userId	integer	query	Optional	User identifier. Filter managed credentials by specific user.
managedCredentialsId	integer	path	Required	Managed credentials identifier.

Request body parameters

Name	Type	Req/Opt	Description
CreateManagedIdentity			Create managed identity
name	string	Optional	Unique name for the managed identity. Must consist of alphanumeric, dash, or underscore characters.
platform	string	Optional	HPC platform type for this managed identity.
config	object	Optional	Base configuration shared by HPC scheduler compute environments: IBM LSF, Slurm, Altair PBS, Moab, and Univa Grid Engine.
config.workDir	string	Optional	Compute environment working directory.
config.preRunScript	string	Optional	Script that executes in the nf-launch script prior to invoking Nextflow processes. See Pre and post-run scripts.
config.postRunScript	string	Optional	Script that executes after all Nextflow processes have completed. See Pre and post-run scripts.
config.nextflowConfig	string	Optional	Additional Nextflow configuration content.
config.launchDir	string	Optional	Launch directory for Nextflow execution.
config.userName	string	Optional	Username for SSH authentication to the HPC cluster.
config.hostName	string	Optional	Hostname or IP address of the HPC cluster head node.
config.port	integer	Optional	SSH port for connecting to the HPC cluster. Default: 22.
config.headQueue	string	Optional	Queue name for submitting the Nextflow head job.
config.computeQueue	string	Optional	Queue name for submitting Nextflow compute jobs.
config.maxQueueSize	integer	Optional	Maximum number of jobs that can be queued at one time.
config.headJobOptions	string	Optional	Additional options for the head job submission.
config.propagateHeadJobOptions	boolean	Optional	If true, head job options are propagated to compute jobs. Default: false.
config.discriminator	string	Optional	Property to select the compute config platform.
config.environment	array	Optional	Array of environment variables for the compute environment.
config.environment[].name	string	Required	Environment variable name.
config.environment[].value	string	Required	Environment variable value.
config.environment[].head	boolean	Optional	Apply this variable to the Nextflow head job.
config.environment[].compute	boolean	Optional	Apply this variable to the Nextflow compute jobs.
UpdateManagedIdentity			Update managed identity
managedIdentity	object	Optional	Managed identity object for an HPC platform, including its platform-specific configuration.
managedIdentity.id	integer	Optional	Managed identity identifier.
managedIdentity.name	string	Optional	Name of the managed identity.
managedIdentity.platform	string	Optional	HPC platform type.
managedIdentity.config	object	Optional	Base configuration shared by HPC scheduler compute environments: IBM LSF, Slurm, Altair PBS, Moab, and Univa Grid Engine.
managedIdentity.config.workDir	string	Optional	Compute environment working directory.
managedIdentity.config.preRunScript	string	Optional	Script that executes in the nf-launch script prior to invoking Nextflow processes. See Pre and post-run scripts.
managedIdentity.config.postRunScript	string	Optional	Script that executes after all Nextflow processes have completed. See Pre and post-run scripts.
managedIdentity.config.nextflowConfig	string	Optional	Additional Nextflow configuration content.
managedIdentity.config.launchDir	string	Optional	Launch directory for Nextflow execution.
managedIdentity.config.userName	string	Optional	Username for SSH authentication to the HPC cluster.
managedIdentity.config.hostName	string	Optional	Hostname or IP address of the HPC cluster head node.
managedIdentity.config.port	integer	Optional	SSH port for connecting to the HPC cluster. Default: 22.
managedIdentity.config.headQueue	string	Optional	Queue name for submitting the Nextflow head job.
managedIdentity.config.computeQueue	string	Optional	Queue name for submitting Nextflow compute jobs.
managedIdentity.config.maxQueueSize	integer	Optional	Maximum number of jobs that can be queued at one time.
managedIdentity.config.headJobOptions	string	Optional	Additional options for the head job submission.
managedIdentity.config.propagateHeadJobOptions	boolean	Optional	If true, head job options are propagated to compute jobs. Default: false.
managedIdentity.config.discriminator	string	Optional	Property to select the compute config platform.
managedIdentity.config.environment	array	Optional	Array of environment variables for the compute environment.
managedIdentity.config.environment[].name	string	Required	Environment variable name.
managedIdentity.config.environment[].value	string	Required	Environment variable value.
managedIdentity.config.environment[].head	boolean	Optional	Apply this variable to the Nextflow head job.
managedIdentity.config.environment[].compute	boolean	Optional	Apply this variable to the Nextflow compute jobs.
CreateManagedCredentials			Create managed credentials
provider	string	Optional	Authentication provider type. Currently supports ssh.
credentials	object	Optional	Cloud provider or service credentials for authentication. Used to connect compute environments, access storage, and integrate with external services.
credentials.id	string	Optional	Credentials identifier.
credentials.name	string	Required	Unique name for the credentials. Must be 1-100 alphanumeric, dash, or underscore characters.
credentials.description	string	Optional	Optional description of the credentials and their intended use.
credentials.provider	string	Required	Credentials provider type. One of aws, azure, azure_entra, google, github, github_app, gitlab, bitbucket, ssh, k8s, container-reg, tw-agent, codecommit, gitea, azurerepos, seqeracompute, azure-cloud, or s3. Maximum 16 characters.
credentials.baseUrl	string	Optional	Base URL for the container registry server. Required for container registry credentials — defaults to docker.io).
credentials.category	string	Optional	Credential category used to group providers by purpose, for example cloud-compute, scm-host, or container-reg.
credentials.deleted	boolean	Optional	If true, the credential record has been soft-deleted and is retained only for internal reference.
credentials.lastUsed	string	Optional	Timestamp when the credentials were last used by Seqera Platform.
credentials.dateCreated	string	Optional	Timestamp when the credential record was created.
credentials.lastUpdated	string	Optional	Timestamp when the credential record was last updated.
credentials.keys	object	Optional	Authentication keys and secrets for a credentials record. The concrete schema is selected by the discriminator value, which matches the parent provider field.
credentials.keys.discriminator	string	Optional	Read-only provider discriminator for the concrete credentials payload. This value identifies which keys schema applies and matches the parent provider field.
credentials.lastValidated	string	Optional	Timestamp of the most recent completed validation probe, whether it succeeded or the provider authoritatively rejected the credentials. Transient probe failures do not update this value. Can be null if the credentials have never been validated.
credentials.message	string	Optional	Provider-supplied error detail captured when status changes to INVALID. Cleared to null when status returns to AVAILABLE. Maximum 4096 characters: longer provider messages are truncated and end with the suffix (truncated).
credentials.status	object	Optional	Credentials validation status: AVAILABLE if the last probe succeeded or no probe has run yet, or INVALID if the provider authoritatively rejected the last probe (see message). Transient probe failures, such as network errors or 5xx responses, leave this value unchanged.
metadata	object	Optional	Additional metadata for managed credentials.
metadata.discriminator	string	Optional	Type discriminator for metadata structure (read-only).
UpdateManagedCredentials			Update managed credentials
provider	string	Optional	Authentication provider type. Currently supports ssh.
credentials	object	Optional	Cloud provider or service credentials for authentication. Used to connect compute environments, access storage, and integrate with external services.
credentials.id	string	Optional	Credentials identifier.
credentials.name	string	Required	Unique name for the credentials. Must be 1-100 alphanumeric, dash, or underscore characters.
credentials.description	string	Optional	Optional description of the credentials and their intended use.
credentials.provider	string	Required	Credentials provider type. One of aws, azure, azure_entra, google, github, github_app, gitlab, bitbucket, ssh, k8s, container-reg, tw-agent, codecommit, gitea, azurerepos, seqeracompute, azure-cloud, or s3. Maximum 16 characters.
credentials.baseUrl	string	Optional	Base URL for the container registry server. Required for container registry credentials — defaults to docker.io).
credentials.category	string	Optional	Credential category used to group providers by purpose, for example cloud-compute, scm-host, or container-reg.
credentials.deleted	boolean	Optional	If true, the credential record has been soft-deleted and is retained only for internal reference.
credentials.lastUsed	string	Optional	Timestamp when the credentials were last used by Seqera Platform.
credentials.dateCreated	string	Optional	Timestamp when the credential record was created.
credentials.lastUpdated	string	Optional	Timestamp when the credential record was last updated.
credentials.keys	object	Optional	Authentication keys and secrets for a credentials record. The concrete schema is selected by the discriminator value, which matches the parent provider field.
credentials.keys.discriminator	string	Optional	Read-only provider discriminator for the concrete credentials payload. This value identifies which keys schema applies and matches the parent provider field.
credentials.lastValidated	string	Optional	Timestamp of the most recent completed validation probe, whether it succeeded or the provider authoritatively rejected the credentials. Transient probe failures do not update this value. Can be null if the credentials have never been validated.
credentials.message	string	Optional	Provider-supplied error detail captured when status changes to INVALID. Cleared to null when status returns to AVAILABLE. Maximum 4096 characters: longer provider messages are truncated and end with the suffix (truncated).
credentials.status	object	Optional	Credentials validation status: AVAILABLE if the last probe succeeded or no probe has run yet, or INVALID if the provider authoritatively rejected the last probe (see message). Transient probe failures, such as network errors or 5xx responses, leave this value unchanged.
metadata	object	Optional	Additional metadata for managed credentials.
metadata.discriminator	string	Optional	Type discriminator for metadata structure (read-only).