Source configuration

config.sources names each source to run and tells Data Serve which vendor credential to use.

Source identifiers

<provider>__<source>

Both parts are lowercase, spaces become underscores, and the separator is two underscores. Provider punctuation remains. IP-Api and Geolocation become ip-api__geolocation.

Unknown identifiers return HTTP 200 with Adapter not found for <identifier> in status; other sources continue.

Confirmation needed: Confirm whether available source identifiers are public or account-specific. A public list needs a separate maintained page.

Configuration values

{
  "sources": {
    "ip-api__geolocation": true,
    "dsmock__person_alpha": {},
    "vendor__product": {
      "credentials": { "cred_id": "crd_01k9j3bfxjedvvtq3jx43y8q8d" }
    }
  }
}

Keys other than credentials inside a source object are ignored by /data.

Credentials

Stored credential

{
  "sources": {
    "vendor__product": {
      "credentials": { "cred_id": "crd_01k9j3bfxjedvvtq3jx43y8q8d" }
    }
  }
}

This is the recommended method.

Credential fields

{
  "sources": {
    "vendor__product": {
      "credentials": {
        "username": "<username>",
        "password": "<password>"
      }
    }
  }
}

The fields depend on the source. Sending them puts vendor secrets in the body.

No credential

If none is supplied, Data Serve uses the organization’s default stored credential for that source.

Resolution order

1. Fields in config.sources.<source>.credentials.
2. The stored credential named by cred_id.
3. The organization default for the source.

/data does not auto-select credentials. /func can when the workflow enables it. See Run a data function.

Credential validation

Resolved credentials are filtered to declared source fields and validated against the source credential schema. A missing required field fails only that source.

Confirmation needed: Confirm the exact public wording of the missing-credential status message before clients rely on the example text.

Security

Body credentials apply only to that request and are not stored. Production transaction redaction removes them under the default production level. Prefer cred_id so the secret does not leave Datastruct’s boundary.