# Supported authentication pattern for calling the SQL Queries API from an RStudio Code Workspace using FOUNDRY\_TOKEN / FOUNDRY\_PROXY\_URL

**URL:** <https://community.palantir.com/t/supported-authentication-pattern-for-calling-the-sql-queries-api-from-an-rstudio-code-workspace-using-foundry-token-foundry-proxy-url/7176>\
**Category:** Ask the Community\
**Tags:** code-repositories\
**Created:** [September 3, 2026, 6:20pm UTC](https://community.palantir.com/t/supported-authentication-pattern-for-calling-the-sql-queries-api-from-an-rstudio-code-workspace-using-foundry-token-foundry-proxy-url/7176 "2026-09-03T18:20:06Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rubble999](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@rubble999](https://community.palantir.com/u/rubble999)\
**Post date:** [September 3, 2026, 6:20pm UTC](https://community.palantir.com/t/supported-authentication-pattern-for-calling-the-sql-queries-api-from-an-rstudio-code-workspace-using-foundry-token-foundry-proxy-url/7176/1 "2026-09-03T18:20:06Z")

</div>

We are testing the Foundry SQL Queries API from an RStudio Code Workspace and have a working implementation using the Python `foundry-platform-sdk` through R `reticulate`.

The working pattern is approximately:

```auto
fs <- reticulate::import("foundry_sdk")

token <- Sys.getenv("FOUNDRY_TOKEN")
proxy_url <- Sys.getenv("FOUNDRY_PROXY_URL")

client <- fs$FoundryClient(
  auth = fs$UserTokenAuth(token),
  hostname = proxy_url
)

query_status <- client$sql_queries$SqlQuery$execute(
  query = query,
  fallback_branch_ids = list("T1DEV")
)

query_id <- query_status$query_id

```

We then poll:

```auto
client$sql_queries$SqlQuery$get_status(query_id)

```

and retrieve the result using:

```auto
client$sql_queries$SqlQuery$get_results(query_id)

```

This is working successfully from the Code Workspace and appears to route the Platform SDK calls through the workspace-provided `FOUNDRY_PROXY_URL`.

We would like to confirm whether this is an **intended and supported authentication pattern for Platform API calls originating from a Code Workspace** , rather than relying on an implementation detail.

1. **What is `FOUNDRY_TOKEN` in a Code Workspace?**

2. **What is the expected lifetime of `FOUNDRY_TOKEN`?**

3. **Is `FOUNDRY_TOKEN` automatically refreshed or rotated while the Code Workspace remains active?**

4. **How should token rotation be handled by a long-running client?**

In our current implementation the token is read once when the client is created:

```auto
token <- Sys.getenv("FOUNDRY_TOKEN")
client <- fs$FoundryClient(
  auth = fs$UserTokenAuth(token),
  hostname = proxy_url
)

```

If the Code Workspace credential expires or rotates while the R session remains active, is the existing `FoundryClient` expected to continue working?

Or should application code periodically reread the workspace credential and recreate the SDK client?

1. **How does this interact with asynchronous SQL Queries API calls?**

`SqlQuery.execute()` returns a query ID and the query can continue running asynchronously.

The client then makes separate authenticated calls to:

```auto
GET /api/v2/sqlQueries/{queryId}/getStatus
GET /api/v2/sqlQueries/{queryId}/getResults

```

What happens if the access token used to submit the query expires before `getStatus` or `getResults` is called?

For example:

```auto
t0 POST /sqlQueries/execute
          token A valid
          -> query ID returned

t0 + 20m query still running

t0 + 30m token A expires / rotates

t0 + 35m GET /getStatus

```

Should the status/results request simply be made using a newly issued workspace token?