redact-secret · Report
Personal access token
dapi-prefixed 32-hex personal access token, optionally suffixed -<digit> after rotation.
redact-secret#308 (product PR #665) landed on the product main after 0.1.0-beta.6; the pinned published package predates it. OAuth client secrets are a separately documented scope extension, not this family.
Research record
From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-25 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.
Format
Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.
What it looks like
- Descriptive pattern
^dapi[0-9a-f]{32}$
Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.
Format facts
Provider documented ·
mutable-property-source· current · observed 2026-09-23Documentation for the one property varied in legacy twin fixtures (Purview Azure Databricks PAT definition): learn.microsoft.com states the format as "A combination of 32 characters consisting of letters and digits" over a-f/A-F/0-9 and lists dapi among its keywords. It backs a length twin only; the lowercase-only alphabet, the dapi prefix as part of the value and the rotation suffix stay tool-corroborated and the positive tier is unchanged
- learn.microsoft.com/en-us/purview/sit-defn-azure-databricks-personal-access-tokenprovider-documentation · last read 2026-09-25 · latest outcome read · supports learn.microsoft.com states the format as "A combination of 32 characters consisting of letters and digits" over a-f/A-F/0-9 and lists dapi among its keywords. It backs a length twin only; the lowercase-only alphabet, the dapi prefix as part of the value and the rotation suffix stay tool-corroborated and the positive tier is unchanged
Tool corroborated ·
tool-corroboration· current · observed 2026-09-23Pinned scanner rules are consistent with the contract grammar (2 artifacts: gitleaks 8.30.1; trufflehog 3.97.4).
- gitleaks/gitleaks @ v8.30.1: config/gitleaks.tomlscanner-rule-source · last read 2026-10-04 · latest outcome read · supports gitleaks 8.30.1: gitleaks.toml
- trufflesecurity/trufflehog @ v3.97.4: pkg/detectors/databrickstoken/databrickstoken.goscanner-rule-source · last read 2026-09-23 · latest outcome read · supports trufflehog 3.97.4: databrickstoken/databrickstoken
Tool corroborated ·
dossier-research· current · observed 2026-09-25Legacy dossier research (verdict ready, tier T2) cited 3 sources; the dossier does not attribute sources to individual properties.
- docs.databricks.com/aws/en/dev-tools/auth/patprovider-documentation · last read 2026-09-25 · latest outcome read · supports Cited by the legacy dossier research for this family
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/582/README.mdproject-research-note · last read 2026-09-25 · latest outcome read · supports Final research evidence recorded by the legacy dossier
- learn.microsoft.com/en-us/purview/sit-defn-azure-databricks-personal-access-tokenprovider-documentation · last read 2026-09-25 · latest outcome read · supports Cited by the legacy dossier research for this family
Tool corroborated ·
taxonomy-sources· current · observed 2026-09-25The legacy taxonomy lists 2 sources for this family. The taxonomy records no date; the dossier researchedAt is used as the observed-at date.
- docs.databricks.com/aws/en/dev-tools/auth/patprovider-documentation · last read 2026-09-25 · latest outcome read · supports Listed as a source for this family in the legacy taxonomy
- learn.microsoft.com/en-us/purview/sit-defn-azure-databricks-personal-access-tokenprovider-documentation · last read 2026-09-25 · latest outcome read · supports Listed as a source for this family in the legacy taxonomy
Open questions
No open question is recorded for this revision.
Benchmark dossier notes
From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
- Shape
dapifollowed by 32 lowercase hex characters, optionally followed by-and a digit after rotation. The suffix rests on four scanner rules only and its meaning, digit count and even existence differ across them; since 2026-09-24 it is outside the benchmark's claim. Uppercase hex is treated as an intentional false negative.- Basis
- T2. No provider prose states any of the grammar (#582 fetched the AWS and Azure PAT pages). gitleaks, trufflehog and Nosey Parker agree on
dapi+ 32 lowercase hex. Microsoft Purview's entity page gives only a 32-character length, admitsA-F, and its own example contradicts its pattern. GitHub's partner list has 12 Databricks secret types; this family coversdapionly. - Issuance
- not attempted; measuring case and suffix needs one issued token (#697).
- Contract in core
- detector-families.md (
databricks_personal_access_token, always redacted; the prefix makes it bare-detectable).
In this benchmark
Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
- Fixtures
- 47
- Left readable
- 0
- Redacted too much
- 0
- False alarms
- 0
47 fixtures: 20 expect a redaction, 27 must stay quiet. See every row
| Evidence level | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| T2Tool-corroborated | 33 | 0 | 0 | 0 |
| T3Project policy | 7 | 0 | 0 | 0 |
| T0Pending review | 7 | 0 | 0 | 0 |
Every scanner on the same fixtures
In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.
| Scanner | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engine1 rule targets it | 47 | 0 | 0 | 0 |
| gitleaksRepository scanner · 8.30.1 · Directory scan · default rules1 rule targets it | 47 | 0 | 0 | 0 |
| redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped | 47 | 0 | 0 | 0 |
| trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabled1 rule targets it | 47 | 6 | 0 | 0 |
Benchmark dossier questions
Things the sources do not settle. They are listed so nobody reads them as settled.
- Open caveat
- No Databricks page states the dapi prefix, length or alphabet; uppercase hex and the optional -<digit> suffix are disputed between sources. Needs one issued token (recorded in #697).
Looks like it, but isn't
Values the dossier records as resembling this credential without being one.
- Collisions
- workspace hostnames (
dbc-...,adb-...) and thetoken_idreturned besidetoken_valueare public. OAuth client secrets are a separately documented scope extension, not this family.
Scanner rules for this family
Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.
| Scanner | Rule | What the rule matches |
|---|---|---|
| flare-redact · rules 1.6.1 | databricks_token | dapi + 32 hex, optional -digit |
| gitleaks · rules 8.30.1 | databricks-api-token | dapi + 32 hex, optional -digit |
| trufflehog · rules 3.97.4 | databrickstoken | dapi + 32 hex, optional -digit |
No rule maps to this family in openredaction.
Fixtures in this family
47 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
| Fixture | Kind and evidence | redact-secret |
|---|---|---|
databricks-personal-access-token-bare-shape-baredatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-bare-shape-quoteddatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-bare-shape-unicode-crlfdatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-cli-env-prefixdatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-debug-logdatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-tokens-create-jsondatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-actions-envdatabricks · unsettled-evidence-input | Pending reviewT0 · Pending | Unscored |
databricks-personal-access-token-actions-secret-referencedatabricks · templated-reference | Must not flagT3 · Project policy | Quiet |
databricks-personal-access-token-bare-shape-alphabet-bare-twindatabricks · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
databricks-personal-access-token-bare-shape-alphabet-quoted-twindatabricks · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
databricks-personal-access-token-bare-shape-alphabet-unicode-crlf-twindatabricks · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
databricks-personal-access-token-bare-shape-bare-twindatabricks · wrong-length | Must not flagT2 · Tool-corroborated · twin | Quiet |
databricks-personal-access-token-bare-shape-quoted-twindatabricks · wrong-length | Must not flagT2 · Tool-corroborated · twin | Quiet |
databricks-personal-access-token-bare-shape-unicode-crlf-twindatabricks · wrong-length | Must not flagT2 · Tool-corroborated · twin | Quiet |
databricks-personal-access-token-cfg-template-placeholderdatabricks · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
databricks-personal-access-token-compose-alphabet-twindatabricks · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
databricks-personal-access-token-compose-envdatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-compose-long-twindatabricks · wrong-length | Must not flagT2 · Tool-corroborated · twin | Quiet |
databricks-personal-access-token-compose-prefix-twindatabricks · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
databricks-personal-access-token-curl-token-userdatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-databrickscfgdatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-envdatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-gitlab-ci-variablesdatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-identifier-prefix-near-missdatabricks · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
databricks-personal-access-token-jdbc-urldatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-job-run-url-public-iddatabricks · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
databricks-personal-access-token-label-prosedatabricks · benign-lookalike | Must not flagT3 · Project policy | Quiet |
databricks-personal-access-token-maskdatabricks · benign-lookalike | Must not flagT3 · Project policy | Quiet |
databricks-personal-access-token-oauth-note-prosedatabricks · prose-mention | Must not flagT3 · Project policy | Quiet |
databricks-personal-access-token-prefix-onlydatabricks · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
databricks-personal-access-token-public-iddatabricks · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
databricks-personal-access-token-referencedatabricks · benign-lookalike | Must not flagT3 · Project policy | Quiet |
databricks-personal-access-token-rest-bearerdatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-rotated-shape-baredatabricks · unsettled-evidence-input | Pending reviewT0 · Pending | Unscored |
databricks-personal-access-token-rotated-shape-bare-twindatabricks · unsettled-evidence-input | Pending reviewT0 · Pending | Unscored |
databricks-personal-access-token-rotated-shape-quoteddatabricks · unsettled-evidence-input | Pending reviewT0 · Pending | Unscored |
databricks-personal-access-token-rotated-shape-quoted-twindatabricks · unsettled-evidence-input | Pending reviewT0 · Pending | Unscored |
databricks-personal-access-token-rotated-shape-unicode-crlfdatabricks · unsettled-evidence-input | Pending reviewT0 · Pending | Unscored |
databricks-personal-access-token-rotated-shape-unicode-crlf-twindatabricks · unsettled-evidence-input | Pending reviewT0 · Pending | Unscored |
databricks-personal-access-token-sdk-workspace-clientdatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-secret-scope-referencedatabricks · templated-reference | Must not flagT3 · Project policy | Quiet |
databricks-personal-access-token-shell-exportdatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-short-bodydatabricks · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
databricks-personal-access-token-terraform-providerdatabricks · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
databricks-personal-access-token-truncated-audit-near-missdatabricks · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
databricks-personal-access-token-wheel-checksum-encoded-valuedatabricks · benign-encoded-value | Must not flagT2 · Tool-corroborated | Quiet |
databricks-personal-access-token-workspace-ids-public-iddatabricks · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
Sources
Researched 2026-09-25.
Documentation and code
- docs.databricks.com/aws/en/dev-tools/auth/pat
- learn.microsoft.com/en-us/purview/sit-defn-azure-databricks-personal-access-token
Research log
- redact-secret/redact-secret#582Research issue
- redact-secret/redact-secret#697Research issue
- redact-secret/redact-secret#698Research issue
- Final evidence, pinned to a commit/redact-secret/redact-secret/blob/8b6a5fde52ecb4dfce13f09c7a947062d21483c7/docs/audits/evidence/582/README.md