Your error message, "Invalid service principal id," typically indicates a mismatch or formatting problem with the service principal's unique identifier in your API request. Although you checked the client_id, this value is not always the one needed for the API—in fact, Databricks distinguishes between client_id (application ID) and the internal service principal UUID or databricks-specific id. Using the wrong type or mixing up the Databricks account_id and service principal id often causes this specific BAD_REQUEST.​

Key Troubleshooting Steps

• Double-check that the service principal ID used in the API endpoint is the actual Databricks service principal UUID—not the client_id or any Azure identifier. You can get this ID from the Databricks "User management" tab in the account console under the Service Principals section.​

• Confirm you are targeting the right API endpoint: For secret creation, the path should be /api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/credentials/secrets with both {account_id} and {service_principal_id} exactly as Databricks expects them.​

• The "lifetime" field in your request body should be given as a number in seconds (not a string with an "s" suffix). For example: { "lifetime": 31536000 }.

Example Correct API Request

• Endpoint:
  POST https://accounts.cloud.databricks.com/api/2.0/accounts/{account_id}/servicePrincipals/{service_princ...

• Headers:
  Authorization: Bearer <token>
Content-Type: application/json

• Body:

   

  text

  { "lifetime": 31536000 }

• Replace {account_id} and {service_principal_id} with the precise values from your Databricks console.

Additional Notes

• If using automation, ensure you're not accidentally swapping the account_id and service principal id in the URL.​

• Databricks UI and the REST API sometimes refer to IDs differently than Azure AD. Always copy the identifiers straight from the Databricks account console.​

Verifying these details should help fix the BAD_REQUEST error. If you are still facing the issue, log into the Databricks account console, list your service principals, and copy their UUID from there for use in your API call.​

I followed instructions to the "T" and can confirm I was using service principal UUID as the servicePrincipal ID in the URL and modified the body to reflect as suggested.