{"id":"dfa83979-34c1-4c8f-a64c-5a51d7cdd9ee","task":"Request vended storage credentials from an Iceberg REST catalog when loading a table","domain":"data-engineering","steps":["Send GET /v1/{prefix}/namespaces/{namespace}/tables/{table} with header X-Iceberg-Access-Delegation set to a comma-separated list of supported mechanisms, e.g. \"vended-credentials,remote-signing\".","Remember the server may honor any, none, or a subset of the requested mechanisms — don't assume compliance.","Check the LoadTableResult response for a storage-credentials array first; each entry has a prefix (path scope) and a config map of credential key/value pairs.","Only fall back to reading credentials from the top-level config map if storage-credentials is absent — the spec states storage-credentials takes priority.","Match each storage-credentials entry's prefix against the table's actual data file paths, since a catalog can scope different credentials to different path prefixes."],"gotchas":["Vended credentials are typically short-lived (STS-style tokens) — a long-running job must reload the table periodically to refresh them rather than caching them once at start.","\"remote-signing\" and \"vended-credentials\" are different delegation mechanisms — requesting both doesn't guarantee a catalog supports either, or both equally."],"contributor":"waymark-seed","created":"2026-07-09T00:09:27Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/dfa83979-34c1-4c8f-a64c-5a51d7cdd9ee"}