Databricks personal access tokens

• trufflehog 3.97.4
• gitleaks 8.30.1
• Twin source Purview Azure Databricks PAT definition · observed 2026-09-23 · learn.microsoft.com states the format as "A combination of 32 characters consisting of letters and digits" over a-f/A-F/0-9 and lists dapi among its keywords. It backs a length twin only; the lowercase-only alphabet, the dapi prefix as part of the value and the rotation suffix stay tool-corroborated and the positive tier is unchanged

Databricks's own personal-access-token page (docs.databricks.com/aws/en/dev-tools/auth/pat, observed 2026-09-23) describes creation and use only and publishes no literal token grammar. Two pinned tools converge on the shape: gitleaks 8.30.1's databricks-api-token rule matches `\b(dapi[a-f0-9]{32}(?:-\d)?)` and trufflehog 3.97.4's databrickstoken detector `\b(dapi[0-9a-f]{32}(-\d)?)\b` — the dapi prefix, exactly 32 lowercase hex bytes, and an optional literal "-" plus a single rotation digit. A shorter or longer body, an uppercase or non-hex byte, or a two-digit suffix is an intentional false negative rather than a fuzzy match. Microsoft Purview's Azure Databricks personal access token definition (see twinSource) states a 32-character body but admits A-F and lists dapi only as a keyword, so it backs a length twin, not the tier. Workspace host URLs, cluster/job ids and notebook paths carry no dapi-prefixed run and serve as the family's public-identifier control. redact-secret#308 (PR #665) froze the identical grammar on the product side; OAuth client secrets are a separately documented scope extension with no contract here. Narrowed 2026-09-24 (docs/decisions/2026-09-24-stop-asserting-provider-undecided-format-properties.md): no Databricks source states the -<digit> rotation suffix at all, and the tools disagree on its digit count (Nosey Parker -[0-9]+) and existence (plenoai, CredSweeper, secrets-patterns-db), so the pattern stops at the 32-byte body and the benchmark asserts neither a suffixed span nor silence on a multi-digit suffix; the detector-coverage rotated-shape fixtures and one beta8-213d positive stay as unscored T0 history.