✨ Create Azure export storage with SPI authentication

POST

http://localhost:8000/api/storages/export/azure_spi

POST

/api/storages/export/azure_spi

curl -X POST http://localhost:8000/api/storages/export/azure_spi \
     -H "Authorization: Token  <api_key>" \
     -H "Content-Type: application/json" \
     -d '{
  "project": 1
}'

201Created

{
  "created_at": "2024-01-15T09:30:00Z",
  "id": 1,
  "project": 1,
  "type": "azure_spi",
  "account_name": "string",
  "auth_mode": "service_principal",
  "can_delete_objects": true,
  "client_id": "string",
  "client_secret": "string",
  "container": "string",
  "description": "string",
  "last_sync": "2024-01-15T09:30:00Z",
  "last_sync_count": 1,
  "last_sync_job": "string",
  "meta": null,
  "prefix": "string",
  "regex_filter": "string",
  "status": "initialized",
  "synchronizable": true,
  "tenant_id": "string",
  "title": "string",
  "traceback": "string",
  "use_blob_urls": true,
  "user_delegation_key": "string"
}

This endpoint is not available in Label Studio Community Edition. Learn more about Label Studio Enterprise

Create an Azure export storage connection with Service Principal or workload-identity authentication to store annotations. Supports auth_mode=service_principal (default; requires tenant_id, client_id, and client_secret) and auth_mode=workload_identity (secretless; client_secret must be omitted, tenant_id is not required, optional client_id selects a user-assigned managed identity). GET responses never include client_secret.

Authentication

AuthorizationToken

The token (or API key) must be passed as a request header. You can find your user token on the User Account page in Label Studio. Example:

curl https://label-studio-host/api/projects -H “Authorization: Token [your-token]”

Request

This endpoint expects an object.

projectintegerRequired

A unique integer value identifying this project.

account_namestring or nullOptional

Azure Blob account name

auth_modeenum or nullOptional

Authentication mode. service_principal uses a client secret. workload_identity uses constrained DefaultAzureCredential (workload identity + managed identity only). Defaults to service_principal.

service_principal - Service Principal
workload_identity - Workload identity

Allowed values:

can_delete_objectsboolean or nullOptional

Deletion from storage enabled

client_idstring or nullOptional

For service_principal: Azure app registration client ID. For workload_identity: optional user-assigned managed identity client ID.

client_secretstring or nullOptional

Azure Blob Service Principal client secret. Required when auth_mode is service_principal (or omitted). Must be omitted when auth_mode is workload_identity.

containerstring or nullOptional

Azure blob container

descriptionstring or nullOptional

Cloud storage description

last_syncdatetime or nullOptional

Last sync finished time

last_sync_countinteger or nullOptional0-2147483647

Count of tasks synced last time

last_sync_jobstring or nullOptional<=256 characters

Last sync job ID

metaany or nullOptional

Meta and debug information about storage processes

prefixstring or nullOptional

Azure blob prefix name

regex_filterstring or nullOptional

Cloud storage regex for filtering objects

statusenumOptional

initialized - Initialized
queued - Queued
in_progress - In progress
failed - Failed
completed - Completed
completed_with_errors - Completed with errors

synchronizablebooleanOptionalDefaults to true

tenant_idstring or nullOptional

Azure Tenant ID. Required for service_principal; not used for workload_identity.

titlestring or nullOptional<=256 characters

Cloud storage title

tracebackstring or nullOptional

Traceback report for the last failed sync

use_blob_urlsbooleanOptional

Interpret objects as BLOBs and generate URLs

user_delegation_keystring or nullOptional

User Delegation Key (Backend)

Response

created_atdatetimeRead-only

Creation time

idintegerRead-only

projectinteger