Apache Druid

Overview

Use Apache Druid credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Template ID	druid
Category	Database
Credential Type	API Key

Step 1: Get Credentials

Log in to Imply Polaris

Log in to Imply Polaris (hosted Apache Druid).

Create an API key

Go to Administration > API Keys and create a key (see the Imply Polaris API keys guide).

Copy the key

Copy the key — Polaris keys are used directly after Basic in the Authorization header.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Apache Druid

Go to Managed Secrets > Add Provider > Apache Druid.

Enter credentials

Paste the API Key into the credential field.

Enter the deployment endpoint

Paste the Polaris API host: the organization’s ORG_NAME.api.imply.io host from the Polaris API docs page. Alter derives this credential’s allowed hosts from that exact host, so proxied calls can only ever reach the deployment. The allowlist cannot be widened or edited separately; rotate the credential with a new endpoint to retarget it.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.POST,
    "https://YOUR-ORG.YOUR-REGION.YOUR-CLOUD.api.imply.io/v1/projects/PROJECT_ID/query/sql",
    grant_id="YOUR_GRANT_ID",
    json={"query": "SELECT __time, page, user FROM wikipedia LIMIT 5"},
)

Notes

• Imply Polaris API keys are pre-encoded: the header is Authorization: Basic <api-key> with the key verbatim.
• Self-managed Druid clusters with basic auth enabled use base64(username:password) instead.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path	Notes
projects/list	read	GET	/v1/projects	—
projects/create	write	POST	/v1/projects	—
projects/get	read	GET	/v1/projects/{id}	—
projects/delete	delete	DELETE	/v1/projects/{id}	—
tables/list	read	GET	/v1/projects/{projectId}/tables	—
tables/create	write	POST	/v1/projects/{projectId}/tables	—
tables/get	read	GET	/v1/projects/{projectId}/tables/{tableName}	—
tables/update	write	PUT	/v1/projects/{projectId}/tables/{tableName}	—
events/push	write	POST	/v1/projects/{projectId}/events/{connectionName}	—
jobs/list	read	GET	/v1/projects/{projectId}/jobs	—
jobs/create	write	POST	/v1/projects/{projectId}/jobs	—
jobs/get	read	GET	/v1/projects/{projectId}/jobs/{jobId}	—
jobs/status	read	GET	/v1/projects/{projectId}/jobs/{jobId}/status	—
jobs/cancel	write	POST	/v1/projects/{projectId}/jobs/{jobId}/status	—
jobs/progress	read	GET	/v1/projects/{projectId}/jobs/{jobId}/progress	—
jobs/logs	read	GET	/v1/projects/{projectId}/jobs/{jobId}/logs	—
files/list	read	GET	/v1/projects/{projectId}/files	—
files/upload	write	POST	/v1/projects/{projectId}/files	—
files/get	read	GET	/v1/projects/{projectId}/files/{name}	—
files/delete	delete	DELETE	/v1/projects/{projectId}/files/{name}	—
query/sql	read, write	POST	/v1/projects/{projectId}/query/sql	—
query/statements/create	read, write	POST	/v1/projects/{projectId}/query/sql/statements	—
query/statements/get	read	GET	/v1/projects/{projectId}/query/sql/statements/{queryId}	—
query/statements/results	read	GET	/v1/projects/{projectId}/query/sql/statements/{queryId}/results	—
query/statements/cancel	delete	DELETE	/v1/projects/{projectId}/query/sql/statements/{queryId}	—
connections/list	read	GET	/v1/projects/{projectId}/connections	—
connections/create	admin	POST	/v1/projects/{projectId}/connections	—
apikeys/list	read	GET	/v1/apikeys	—
apikeys/info	read	GET	/v1/apikeyinfo	—
createApiKey	admin	POST	/v1/apikeys	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it); served by the provider but absent from its published spec
createEmbeddingLinkSecretKey	admin	POST	/v1/projects/{projectId}/embedding-links/{id}/key	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it); served by the provider but absent from its published spec