Partner Onboarding Setup Guide

Please confirm the following are already in place. If any of these are missing, contact your Trudenty onboarding contact before starting.

Table of Contents

1. Step 1 - Configure Access to Your Output Tables
2. Step 2 - Grant the API Service Read Access
3. Step 3 - Provide Your Configuration to Trudenty
4. Step 4 - Set Up Authentication
5. Integration Flow Summary

Step 1 - Configure Access to Your Output Tables

The Trust Index pipeline writes output tables into your Databricks workspace. Trudenty can either read these tables directly or read from a copy stored in your own Unity Catalog. You need to decide where the API should read this data from. This step accomplishes that decision and, if needed, sets up a copy of your data under your own control.

Prerequisites

• Unity Catalog enabled in your Databricks workspace
• Permission to create catalogs/schemas (if you choose Option B below)
• The clean room output schema name provided by Trudenty (format: clean_room_output.output_schema_<id>)

Access Options

There are two ways to give the API access to your Trust Index data:

Detailed Instructions on Access Options

If choosing Option A (recommended default):

1. No action is required. No table copy is required. The Trust Index API will read directly from the clean room output schema.
2. Confirm with your Trudenty contact that the schema name they gave you matches the format clean_room_output.output_schema_<id>.
3. The default retention period for clean room outputs is typically 30 days and can be configured if longer retention is required.
4. Ensure that the Partner's Service Principal has read access to this schema.
5. Proceed to Step 2 (which you can skip - see note in Step 2).

If choosing Option B:

1. Open Databricks SQL.
2. Create a new schema in your own catalog (replace acme_workspace with your actual catalog name):
   SQL

   CREATE SCHEMA IF NOT EXISTS acme_workspace.trudenty_output;

3. Copy each of the three required tables into your new schema:
   SQL

   CREATE TABLE IF NOT EXISTS acme_workspace.trudenty_output.consumer_table AS
   SELECT * FROM clean_room_output.output_schema_<id>.consumer_table;
   
   CREATE TABLE IF NOT EXISTS acme_workspace.trudenty_output.consumer_table_reason_code AS
   SELECT * FROM clean_room_output.output_schema_<id>.consumer_table_reason_code;
   
   CREATE TABLE IF NOT EXISTS acme_workspace.trudenty_output.trust_dimension_score AS
   SELECT * FROM clean_room_output.output_schema_<id>.trust_dimension_score;

4. Set up a recurring Databricks job that runs after every new Trust Index compute run, to keep your copy up to date:
   SQL

   INSERT INTO acme_workspace.trudenty_output.consumer_table
   SELECT *
   FROM clean_room_output.output_schema_<id>.consumer_table
   WHERE compute_date >
   (
       SELECT MAX(compute_date)
       FROM acme_workspace.trudenty_output.consumer_table
   );

5. Schedule this job to run at the same frequency as your Trust Index compute runs (confirm this schedule with Trudenty).

Expected Result

• Option A: Nothing changes - you simply confirm the existing schema is accessible.
• Option B: You have a new schema (e.g., acme_workspace.trudenty_output) containing three tables, with a scheduled job keeping them current.

Verification

• Option A: Ask Trudenty to confirm they can query the schema name you were given.
• Option B: Run SELECT COUNT(*) FROM acme_workspace.trudenty_output.consumer_table; and confirm it returns a non-zero number of rows.

Step 2 - Create a Service Principal and Grant Read Access

The Partner must create a dedicated Service Principal that Trudenty will use to authenticate with the Partner's Databricks workspace using OAuth 2.0 Client Credentials.

2.1 Create a Service Principal

Create a dedicated Service Principal that Trudenty will use to access your Databricks workspace.

In Databricks, Navigate to:

Settings → Identity And Access → Service Principals → Add Service Principal

2.2 Grant Permissions

Grant the Service Principal only the minimum permissions required. You will run a small set of commands that tell Databricks: "Allow Trudenty's system to read these three tables, and nothing more." This is a one-time setup per client.

For Option B:

1. Open Databricks SQL.
2. Ask your Trudenty contact for the exact service principal identifier if you don't already have it.
3. Run the following commands, replacing acme_workspace with your catalog name and <your_service_principal_application_id> with your service provider application id:
   SQL

   GRANT USE CATALOG ON CATALOG acme_workspace TO `<your_service_principal_application_id>`;
   
   GRANT USE SCHEMA ON SCHEMA acme_workspace.trudenty_output TO `<your_service_principal_application_id>`;
   
   GRANT SELECT ON TABLE acme_workspace.trudenty_output.consumer_table TO `<your_service_principal_application_id>`;
   
   GRANT SELECT ON TABLE acme_workspace.trudenty_output.consumer_table_reason_code TO `<your_service_principal_application_id>`;
   
   GRANT SELECT ON TABLE acme_workspace.trudenty_output.trust_dimension_score TO `<your_service_principal_application_id>`;

4. Confirm with your Trudenty contact once this has been completed.

For Option A, grant equivalent USE CATALOG, USE SCHEMA, and SELECT permissions on the clean room output schema.

The Service Principal should only have read access to the required tables.

Verification

Run the following to confirm the grants are in place:

SHOW GRANTS ON TABLE acme_workspace.trudenty_output.consumer_table;

2.3 Generate an OAuth Secret

After creating the Service Principal:

Settings
    ↓
Identity & Access
    ↓
Service Principals
    ↓
Select the Service Principal
    ↓
Secrets
    ↓
Generate Secret

Databricks generates secret credentials:

• Client ID
• Client Secret

Step 3 - Provide Your Configuration to Trudenty

Trudenty needs a small set of connection details to set up your dedicated, private API instance. This step is how you securely hand over those details.

Once the Service Principal has been configured and granted access, securely provide the following information to Trudenty.

Configuration Values to Provide

Use a secure credential-sharing method (such as a password manager, encrypted vault, or secure file-sharing solution). Do not send credentials through unsecured email or chat.

Trudenty stores these credentials securely and uses the OAuth 2.0 Client Credentials flow to obtain short-lived access tokens when connecting to the Partner's Databricks SQL Warehouse. The Client Secret is never exposed after onboarding and no Personal Access Token (PAT) is required.

Step 4 - Set Up Authentication

Every request to the Trust Index APIs must be authenticated to ensure it originates from an authorized client. After Trudenty completes your onboarding, dedicated API credentials will be generated for your organization.

As part of the onboarding process, Trudenty will generate and securely provide the following API credentials:

• API Client ID
• API Client Secret

These credentials are used to authenticate every request to the Trust Index APIs.

Include the credentials in the header of every API request:

x-client-id: <your_api_client_id>
x-client-secret: <your_api_client_secret>

Integration Flow Summary

              Clean Room Pipeline
         (Computes Trust Index Results)
                     │
                     ▼
┌─────────────────────────────────────────────┐
│ Step 1 – Configure Access to Output Tables  │
│ • Option A: Read directly                   │
│ • Option B: Copy into your own schema       │
└──────────────────────┬──────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────┐
│ Step 2 – Create Service Principal           │
│ • Generate OAuth Secret                     │ (Option B only)
│ • Grant Read Permissions                    │
└──────────────────────┬──────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────┐
│ Step 3 – Share Configuration with Trudenty  │
│                                             │
│ • Workspace URL                             │
│ • SQL Warehouse HTTP Path                   │
│ • Catalog Name                              │
│ • Schema Name                               │
│ • Databricks Client ID                      │
│ • Databricks Client Secret                  │
└──────────────────────┬──────────────────────┘
                       │
                       ▼
        Trudenty validates the configuration
       and provisions a dedicated API instance
                       │
                       ▼
┌─────────────────────────────────────────────┐
│ Step 4 – Receive API Credentials            │
│                                             │
│ Trudenty issues:                            │
│ • API Client ID                             │
│ • API Client Secret                         │
└──────────────────────┬──────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────┐
│ Step 5 – Call the Trust Index APIs          │
│                                             │
│ Request Headers:                            │
│ x-client-id: <api_client_id>                │
│ x-client-secret: <api_client_secret>        │
│                                             │
│ GET /v1/consumer-trust-index                │
│ GET /v1/consumer-trust-index/history        │
└─────────────────────────────────────────────┘

What's Next

Begin your integration by understanding the API, configuring authentication, and making your first request.