topic API call fails to initiate create Service Principal secret in Get Started Discussions

API call fails to initiate create Service Principal secret

zibi — Tue, 11 Nov 2025 06:36:01 GMT

Hi,

I've constructed an AWS lambda function which is used to auto rotate my Service Principal Secret in the Databricks account.
Authentication is setup with OAuth2, the api call for the token generation is successful but when executing the api call to create secret it fails with Bad Request

Below is a result tested using Postman. I've masked the account_id and client_id.

POST https://accounts.cloud.databricks.com/api/2.0/accounts/q243434j-mock-121k-23kj-342131kjhhh3/servicePrincipals/728394h-mock-40b1-86ce-1d1991u91283/credentials/secrets

Headers
Authorisation: Bearer jsdjshadadhashd348795h235i52ih35i2h5...

Content-Type: application/json

Body

{

"lifetime": "31536000s"

}

{"error_code":"BAD_REQUEST","message":"Invalid service principal id 'q243434j-t373-121k-23kj-342131kjhhh3'","details":[{"@type":"type.googleapis.com/google.rpc.RequestInfo","request_id":"728394h-mock-40b1-86ce-1d1991u91283","serving_data":""}]}

The SP client_id was quadruple checked. Any assistance would be appreciated.

Re: API call fails to initiate create Service Principal secret

mark_ott — Wed, 12 Nov 2025 16:56:41 GMT

Your error message, "Invalid service principal id," typically indicates a mismatch or formatting problem with the service principal's unique identifier in your API request. Although you checked the client_id, this value is not always the one needed for the API—in fact, Databricks distinguishes between client_id (application ID) and the internal service principal UUID or databricks-specific id. Using the wrong type or mixing up the Databricks account_id and service principal id often causes this specific BAD_REQUEST.

Key Troubleshooting Steps

Double-check that the service principal ID used in the API endpoint is the actual Databricks service principal UUID—not the client_id or any Azure identifier. You can get this ID from the Databricks "User management" tab in the account console under the Service Principals section.
Confirm you are targeting the right API endpoint: For secret creation, the path should be /api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/credentials/secrets with both {account_id} and {service_principal_id} exactly as Databricks expects them.
The "lifetime" field in your request body should be given as a number in seconds (not a string with an "s" suffix). For example: { "lifetime": 31536000 }.

Example Correct API Request

Endpoint:
POST https://accounts.cloud.databricks.com/api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/credentials/secrets
Headers:
Authorization: Bearer <token>
Content-Type: application/json
Body:

text

{ "lifetime": 31536000 }
Replace {account_id} and {service_principal_id} with the precise values from your Databricks console.

Additional Notes

If using automation, ensure you're not accidentally swapping the account_id and service principal id in the URL.
Databricks UI and the REST API sometimes refer to IDs differently than Azure AD. Always copy the identifiers straight from the Databricks account console.

Verifying these details should help fix the BAD_REQUEST error. If you are still facing the issue, log into the Databricks account console, list your service principals, and copy their UUID from there for use in your API call.

Re: API call fails to initiate create Service Principal secret

zibi — Thu, 13 Nov 2025 06:53:43 GMT

I followed instructions to the "T" and can confirm I was using service principal UUID as the servicePrincipal ID in the URL and modified the body to reflect as suggested.

{

"lifetime": 31536000

}

Getting below error now after changing the body.

{

"error_code": "MALFORMED_REQUEST",

"message": "Could not parse request object: Error parsing Duration\n at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 21]\n at [Source: UNKNOWN; line: 1, column: 21]",

"details": [

{

"@type": "type.googleapis.com/google.rpc.RequestInfo",

"request_id": "6a543eec-3682-4d13-964a-70ddcb8b0738",

"serving_data": ""

}

]

}

Re: API call fails to initiate create Service Principal secret

zibi — Thu, 13 Nov 2025 13:31:08 GMT

Problem resolved, the I changed the Service Principal ID to use the ID instead of the UUID, this worked perfectly, definitely an error in the documentation.