Databricks
Purpose
Syncs a Databricks workspace into SubImage, including workspace identity, compute, workflows, SQL assets, networking, apps, model serving, and the Unity Catalog data plane.
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
Authentication
Choose one of two methods. OAuth M2M is recommended for persistent deployments because it uses short-lived access tokens instead of a long-lived personal credential.
Personal access token (PAT)
| Field | Secret? | Description |
|---|---|---|
databricks_workspace_url |
No | Workspace URL, e.g. https://dbc-xxxx.cloud.databricks.com |
databricks_token |
Yes | Workspace-admin PAT with all APIs access |
OAuth machine-to-machine (service principal)
| Field | Secret? | Description |
|---|---|---|
databricks_workspace_url |
No | Workspace URL |
databricks_client_id |
No | Workspace-admin service principal application ID |
databricks_client_secret |
Yes | OAuth client secret |
Steps
- In the Databricks workspace, create the credential:
- PAT: go to Settings, Developer, Access tokens, and Generate new token. Select Other APIs and all APIs (not recommended). Use a short lifetime and revoke the token after testing.
- OAuth M2M: create a service principal, then generate an OAuth secret for it (Settings, Identity and access, Service principals).
- Grant the user or service principal the workspace admin role. Full ingestion requires workspace admin access to enumerate SCIM identities and the token management API.
- In SubImage, fill in
databricks_workspace_urland eitherdatabricks_token, or bothdatabricks_client_idanddatabricks_client_secret. - For
databricks_tokenordatabricks_client_secret, choose Secret to paste the credential into SubImage's managed vault, or choose AWS ARN to reference a plaintext secret in your AWS Secrets Manager.
SubImage's inventory requests use read-only GET operations. The credential itself is not read-only: Databricks API scopes authorize families of operations that can include both reads and mutations. Cartography requests the OAuth all-apis scope automatically, and full PAT-based ingestion requires the equivalent all APIs selection. See the Databricks API scope reference.
SubImage currently configures workspace-level ingestion only. Cartography's separate Databricks account-level configuration is not exposed through the SubImage module yet.