Weaviate

Overview

Use Weaviate credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Template ID	weaviate
Category	AI
Credential Type	API Key

Step 1: Get Credentials

Log in to the Weaviate Cloud Console

Log in to the Weaviate Cloud Console.

Open API keys

Select the cluster and open the API Keys section of its Dashboard.

Create a key

Click + New key and name the key. Choose viewer for read-only access, or create a custom role with only the write permissions this integration needs. Use admin only for integrations requiring administrative access, then click Create key.

Copy the key and endpoint

Copy the API key immediately — it is displayed only once — and copy the cluster’s REST Endpoint URL from the same page.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Weaviate

Go to Managed Secrets > Add Provider > Weaviate.

Enter credentials

Paste the API Key into the credential field.

Enter the deployment endpoint

Paste the Cluster REST endpoint. Copy it from the Weaviate Cloud console. Alter derives this credential’s allowed hosts from that exact host, so proxied calls can only ever reach the deployment. The allowlist cannot be widened or edited separately; rotate the credential with a new endpoint to retarget it.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.POST,
    "https://YOUR-CLUSTER.weaviate.cloud/v1/graphql",
    grant_id="YOUR_GRANT_ID",
    json={"query": "{ Get { Article(limit: 5) { title url } } }"},
)

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path	Notes
aliases.delete	delete	DELETE	/aliases/{aliasName}	—
backups.cancel	delete	DELETE	/backups/{backend}/{id}	—
backups.restore.cancel	delete	DELETE	/backups/{backend}/{id}/restore	—
batch.objects.delete	delete	DELETE	/batch/objects	—
cancelReplication	delete, write	POST	/replication/replicate/{id}/cancel	—
deleteAllReplications	delete	DELETE	/replication/replicate	—
deleteNamespace	delete	DELETE	/namespaces/{namespace_id}	—
deleteReplication	delete	DELETE	/replication/replicate/{id}	—
deleteRole	admin, delete	DELETE	/authz/roles/{id}	—
deleteUser	admin, delete	DELETE	/users/db/{user_id}	—
export.cancel	delete	DELETE	/export/{backend}/{id}	—
forceDeleteReplications	delete, write	POST	/replication/replicate/force-delete	—
mcp.delete	delete	DELETE	/mcp	—
objects.class.delete	delete	DELETE	/objects/{className}/{id}	—
objects.class.references.delete	delete	DELETE	/objects/{className}/{id}/references/{propertyName}	—
objects.delete	delete	DELETE	/objects/{id}	—
objects.references.delete	delete	DELETE	/objects/{id}/references/{propertyName}	—
schema.objects.delete	delete	DELETE	/schema/{className}	—
schema.objects.properties.delete	delete	DELETE	/schema/{className}/properties/{propertyName}/index/{indexName}	—
schema.objects.vectors.delete	delete	DELETE	/schema/{className}/vectors/{vectorIndexName}/index	—
tenants.delete	delete	DELETE	/schema/{className}/tenants	—
activateUser	admin, write	POST	/users/db/{user_id}/activate	—
addPermissions	admin, write	POST	/authz/roles/{id}/add-permissions	—
assignRoleToGroup	admin, write	POST	/authz/groups/{id}/assign	—
createRole	admin, write	POST	/authz/roles	—
createUser	admin, write	POST	/users/db/{user_id}	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
aliases.create	write	POST	/aliases	—
backups.create	write	POST	/backups/{backend}	—
batch.objects.create	write	POST	/batch/objects	—
createNamespace	write	POST	/namespaces/{namespace_id}	—
export.create	write	POST	/export/{backend}	—
objects.class.references.create	write	POST	/objects/{className}/{id}/references/{propertyName}	—
objects.references.create	write	POST	/objects/{id}/references/{propertyName}	—
tenants.create	write	POST	/schema/{className}/tenants	—
aliases.get.alias	read	GET	/aliases/{aliasName}	—
backups.create.status	read	GET	/backups/{backend}/{id}	—
backups.list	read	GET	/backups/{backend}	—
backups.restore.status	read	GET	/backups/{backend}/{id}/restore	—
classifications.get	read	GET	/classifications/{id}	—
distributedTasks.get	read	GET	/tasks	—
rotateUserApiKey	admin	POST	/users/db/{user_id}/rotate-key	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
exportUsers	admin	POST	/experimental/export-db-users	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)