Summary
PyIceberg supports inline REST storage-credentials on table responses, but not every vended credential path in the REST Catalog spec.
Related: #2594
Gaps
- Implement
loadCredentials: GET /v1/{prefix}/namespaces/{namespace}/tables/{table}/credentials, including LoadCredentialsResponse, longest-prefix selection, and optional planId / referenced-by.
- Complete scan-planning credential support: apply
storage-credentials from completed planTableScan / fetchPlanningResult responses when reading planned data/delete files, and add the missing async fetchPlanningResult flow.
- Revisit staged create: credential resolution currently depends on
metadata-location, which can be null for staged table metadata.
Done When
- Explicit
loadCredentials responses are parsed and applied.
- Scan-planning credentials are used for planned file reads.
- Existing inline table-response precedence is preserved: matching
storage-credentials win over config.
Summary
PyIceberg supports inline REST
storage-credentialson table responses, but not every vended credential path in the REST Catalog spec.Related: #2594
Gaps
loadCredentials:GET /v1/{prefix}/namespaces/{namespace}/tables/{table}/credentials, includingLoadCredentialsResponse, longest-prefix selection, and optionalplanId/referenced-by.planId/referenced-bystorage-credentialsfrom completedplanTableScan/fetchPlanningResultresponses when reading planned data/delete files, and add the missing asyncfetchPlanningResultflow.metadata-location, which can be null for staged table metadata.Done When
loadCredentialsresponses are parsed and applied.storage-credentialswin overconfig.