{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-ai-search/json-schema/azure-ai-search-search-indexer-data-source-schema.json",
  "title": "SearchIndexerDataSource",
  "description": "Represents a datasource definition, which can be used to configure an indexer.",
  "x-generated": "2026-11-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-ai-search-datasources-datasourcename-api-openapi.yml#/components/schemas/SearchIndexerDataSource",
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "The name of the datasource."
    },
    "description": {
      "type": "string",
      "description": "The description of the datasource."
    },
    "type": {
      "$ref": "#/$defs/SearchIndexerDataSourceType",
      "description": "The type of the datasource."
    },
    "credentials": {
      "$ref": "#/$defs/DataSourceCredentials",
      "description": "Credentials for the datasource.",
      "x-ms-client-flatten": true
    },
    "container": {
      "$ref": "#/$defs/SearchIndexerDataContainer",
      "description": "The data container for the datasource."
    },
    "identity": {
      "$ref": "#/$defs/SearchIndexerDataIdentity",
      "description": "An explicit managed identity to use for this datasource. If not specified and the connection string is a managed identity, the system-assigned managed identity is used. If not specified, the value remains unchanged. If \"none\" is specified, the value of this property is cleared."
    },
    "indexerPermissionOptions": {
      "type": [
        "array",
        "null"
      ],
      "description": "Ingestion options with various types of permission data.",
      "items": {
        "$ref": "#/$defs/IndexerPermissionOption"
      }
    },
    "dataChangeDetectionPolicy": {
      "$ref": "#/$defs/DataChangeDetectionPolicy",
      "description": "The data change detection policy for the datasource."
    },
    "dataDeletionDetectionPolicy": {
      "$ref": "#/$defs/DataDeletionDetectionPolicy",
      "description": "The data deletion detection policy for the datasource."
    },
    "@odata.etag": {
      "type": "string",
      "description": "The ETag of the data source.",
      "x-ms-client-name": "eTag"
    },
    "encryptionKey": {
      "$ref": "#/$defs/SearchResourceEncryptionKey",
      "description": "A description of an encryption key that you create in Azure Key Vault. This key is used to provide an additional level of encryption-at-rest for your datasource definition when you want full assurance that no one, not even Microsoft, can decrypt your data source definition. Once you have encrypted your data source definition, it will always remain encrypted. The search service will ignore attempts to set this property to null. You can change this property as needed if you want to rotate your encryption key; Your datasource definition will be unaffected. Encryption with customer-managed keys is not available for free search services, and is only available for paid services created on or after January 1, 2019."
    }
  },
  "required": [
    "name",
    "type",
    "credentials",
    "container"
  ],
  "$defs": {
    "AzureActiveDirectoryApplicationCredentials": {
      "type": "object",
      "description": "Credentials of a registered application created for your search service, used for authenticated access to the encryption keys stored in Azure Key Vault.",
      "properties": {
        "applicationId": {
          "type": "string",
          "description": "An AAD Application ID that was granted the required access permissions to the Azure Key Vault that is to be used when encrypting your data at rest. The Application ID should not be confused with the Object ID for your AAD Application."
        },
        "applicationSecret": {
          "type": "string",
          "description": "The authentication key of the specified AAD application."
        }
      },
      "required": [
        "applicationId"
      ]
    },
    "DataChangeDetectionPolicy": {
      "type": "object",
      "description": "Base type for data change detection policies.",
      "properties": {
        "@odata.type": {
          "type": "string",
          "description": "The discriminator for derived types."
        }
      },
      "required": [
        "@odata.type"
      ]
    },
    "DataDeletionDetectionPolicy": {
      "type": "object",
      "description": "Base type for data deletion detection policies.",
      "properties": {
        "@odata.type": {
          "type": "string",
          "description": "The discriminator for derived types."
        }
      },
      "required": [
        "@odata.type"
      ]
    },
    "DataSourceCredentials": {
      "type": "object",
      "description": "Represents credentials that can be used to connect to a datasource.",
      "properties": {
        "connectionString": {
          "type": "string",
          "description": "The connection string for the datasource. Set to `<unchanged>` (with brackets) if you don't want the connection string updated. Set to `<redacted>` if you want to remove the connection string value from the datasource."
        }
      }
    },
    "IndexerPermissionOption": {
      "type": "string",
      "description": "Options with various types of permission data to index.",
      "enum": [
        "userIds",
        "groupIds",
        "rbacScope"
      ],
      "x-ms-enum": {
        "name": "IndexerPermissionOption",
        "modelAsString": true,
        "values": [
          {
            "name": "UserIds",
            "value": "userIds",
            "description": "Indexer to ingest ACL userIds from data source to index."
          },
          {
            "name": "GroupIds",
            "value": "groupIds",
            "description": "Indexer to ingest ACL groupIds from data source to index."
          },
          {
            "name": "RbacScope",
            "value": "rbacScope",
            "description": "Indexer to ingest Azure RBAC scope from data source to index."
          }
        ]
      }
    },
    "SearchIndexerDataContainer": {
      "type": "object",
      "description": "Represents information about the entity (such as Azure SQL table or CosmosDB collection) that will be indexed.",
      "properties": {
        "name": {
          "type": "string",
          "description": "The name of the table or view (for Azure SQL data source) or collection (for CosmosDB data source) that will be indexed."
        },
        "query": {
          "type": "string",
          "description": "A query that is applied to this data container. The syntax and meaning of this parameter is datasource-specific. Not supported by Azure SQL datasources."
        }
      },
      "required": [
        "name"
      ]
    },
    "SearchIndexerDataIdentity": {
      "type": "object",
      "description": "Abstract base type for data identities.",
      "properties": {
        "@odata.type": {
          "type": "string",
          "description": "A URI fragment specifying the type of identity."
        }
      },
      "required": [
        "@odata.type"
      ]
    },
    "SearchIndexerDataSourceType": {
      "type": "string",
      "description": "Defines the type of a datasource.",
      "enum": [
        "azuresql",
        "cosmosdb",
        "azureblob",
        "azuretable",
        "mysql",
        "adlsgen2",
        "onelake",
        "sharepoint"
      ],
      "x-ms-enum": {
        "name": "SearchIndexerDataSourceType",
        "modelAsString": true,
        "values": [
          {
            "name": "AzureSql",
            "value": "azuresql",
            "description": "Indicates an Azure SQL datasource."
          },
          {
            "name": "CosmosDb",
            "value": "cosmosdb",
            "description": "Indicates a CosmosDB datasource."
          },
          {
            "name": "AzureBlob",
            "value": "azureblob",
            "description": "Indicates an Azure Blob datasource."
          },
          {
            "name": "AzureTable",
            "value": "azuretable",
            "description": "Indicates an Azure Table datasource."
          },
          {
            "name": "MySql",
            "value": "mysql",
            "description": "Indicates a MySql datasource."
          },
          {
            "name": "AdlsGen2",
            "value": "adlsgen2",
            "description": "Indicates an ADLS Gen2 datasource."
          },
          {
            "name": "OneLake",
            "value": "onelake",
            "description": "Indicates a Microsoft Fabric OneLake datasource."
          },
          {
            "name": "SharePoint",
            "value": "sharepoint",
            "description": "Indicates a SharePoint datasource."
          }
        ]
      }
    },
    "SearchResourceEncryptionKey": {
      "type": "object",
      "description": "A customer-managed encryption key in Azure Key Vault. Keys that you create and manage can be used to encrypt or decrypt data-at-rest, such as indexes and synonym maps.",
      "properties": {
        "keyVaultKeyName": {
          "type": "string",
          "description": "The name of your Azure Key Vault key to be used to encrypt your data at rest."
        },
        "keyVaultKeyVersion": {
          "type": "string",
          "description": "The version of your Azure Key Vault key to be used to encrypt your data at rest."
        },
        "keyVaultUri": {
          "type": "string",
          "description": "The URI of your Azure Key Vault, also referred to as DNS name, that contains the key to be used to encrypt your data at rest. An example URI might be `https://my-keyvault-name.vault.azure.net`."
        },
        "accessCredentials": {
          "$ref": "#/$defs/AzureActiveDirectoryApplicationCredentials",
          "description": "Optional Azure Active Directory credentials used for accessing your Azure Key Vault. Not required if using managed identity instead.",
          "x-ms-client-flatten": true
        },
        "identity": {
          "$ref": "#/$defs/SearchIndexerDataIdentity",
          "description": "An explicit managed identity to use for this encryption key. If not specified and the access credentials property is null, the system-assigned managed identity is used. On update to the resource, if the explicit identity is unspecified, it remains unchanged. If \"none\" is specified, the value of this property is cleared."
        }
      },
      "required": [
        "keyVaultKeyName",
        "keyVaultUri"
      ]
    }
  }
}