API: IAM

Generated from the API's OpenAPI schema. Paths are relative to https://cloud.tebibhost.com. Authentication, errors, pagination and idempotency are on the API overview.

GET/api/v1/orgs/{organization_id}/groups

List Groups (listGroups)

IAM action: iam:DescribeGroup

Parameter	In	Type
`organization_id` required	path	string
`limit`	query	integer (nullable)
`cursor`	query	string (nullable)

Responses

200 OK (Page_GroupOut_)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of Page_GroupOut_

Field	Type	Description
`items`	array of GroupOut
`next_cursor`	string (nullable)

POST/api/v1/orgs/{organization_id}/groups

Create Group (createGroup)

IAM action: iam:CreateGroup

Parameter	In	Type	Description
`organization_id` required	path	string

Request body (JSON, GroupIn)

Field	Type	Description
`description`	string	Default: `""`.
`name` required	string

Responses

201 Created (GroupOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of GroupOut

Field	Type	Description
`created_at`	string (date-time)
`description`	string
`id`	string
`member_count`	integer
`name`	string
`trn`	string

GET/api/v1/orgs/{organization_id}/groups/{group_id}

Get Group (getGroup)

IAM action: iam:DescribeGroup

Parameter	In	Type	Description
`organization_id` required	path	string
`group_id` required	path	string

Responses

200 OK (GroupOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of GroupOut

Field	Type	Description
`created_at`	string (date-time)
`description`	string
`id`	string
`member_count`	integer
`name`	string
`trn`	string

PATCH/api/v1/orgs/{organization_id}/groups/{group_id}

Update Group (updateGroup)

IAM action: iam:UpdateGroup

Parameter	In	Type	Description
`organization_id` required	path	string
`group_id` required	path	string

Request body (JSON, GroupPatch)

Field	Type	Description
`description`	string (nullable)

Responses

200 OK (GroupOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of GroupOut

Field	Type	Description
`created_at`	string (date-time)
`description`	string
`id`	string
`member_count`	integer
`name`	string
`trn`	string

DELETE/api/v1/orgs/{organization_id}/groups/{group_id}

Delete Group (deleteGroup)

IAM action: iam:DeleteGroup

Parameter	In	Type	Description
`organization_id` required	path	string
`group_id` required	path	string

Responses

204 No Content
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

GET/api/v1/orgs/{organization_id}/groups/{group_id}/members

List Group Members (listGroupMembers)

IAM action: iam:DescribeGroup

Parameter	In	Type	Description
`organization_id` required	path	string
`group_id` required	path	string

Responses

200 OK (array of GroupMemberOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

PUT/api/v1/orgs/{organization_id}/groups/{group_id}/members/{user_id}

Add Group Member (addGroupMember)

IAM action: iam:AddUserToGroup

Parameter	In	Type
`organization_id` required	path	string
`group_id` required	path	string
`user_id` required	path	string

Responses

204 No Content
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

DELETE/api/v1/orgs/{organization_id}/groups/{group_id}/members/{user_id}

Remove Group Member (removeGroupMember)

IAM action: iam:RemoveUserFromGroup

Parameter	In	Type
`organization_id` required	path	string
`group_id` required	path	string
`user_id` required	path	string

Responses

204 No Content
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

GET/api/v1/orgs/{organization_id}/guardrails

List Guardrails (listGuardrails)

The organization's guardrails. Every one must allow a request; none attached means no limit. They bind every principal, OrgOwners included, except for iam:*Guardrail*.

IAM action: iam:ListGuardrails

Parameter	In	Type
`organization_id` required	path	string
`limit`	query	integer (nullable)
`cursor`	query	string (nullable)

Responses

200 OK (Page_GuardrailOut_)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of Page_GuardrailOut_

Field	Type	Description
`items`	array of GuardrailOut
`next_cursor`	string (nullable)

POST/api/v1/orgs/{organization_id}/guardrails

Attach Guardrail (attachGuardrail)

Attach a policy as a guardrail. Its statements cap every principal in the organization (Principal is not allowed in them); it grants nothing by itself.

IAM action: iam:AttachGuardrail

Parameter	In	Type	Description
`organization_id` required	path	string

Request body (JSON, GuardrailIn)

Field	Type	Description
`policy` required	string	Policy ID, TRN or name: the organization's or a managed one.

Responses

201 Created (GuardrailOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of GuardrailOut

Field	Type	Description
`created_at`	string (date-time)
`created_by`	string
`id`	string
`policy_id`	string
`policy_name`	string
`policy_trn`	string
`trn`	string

GET/api/v1/orgs/{organization_id}/guardrails/{guardrail_id}

Get Guardrail (getGuardrail)

IAM action: iam:DescribeGuardrail

Parameter	In	Type	Description
`organization_id` required	path	string
`guardrail_id` required	path	string

Responses

200 OK (GuardrailOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of GuardrailOut

Field	Type	Description
`created_at`	string (date-time)
`created_by`	string
`id`	string
`policy_id`	string
`policy_name`	string
`policy_trn`	string
`trn`	string

DELETE/api/v1/orgs/{organization_id}/guardrails/{guardrail_id}

Detach Guardrail (detachGuardrail)

IAM action: iam:DetachGuardrail

Parameter	In	Type	Description
`organization_id` required	path	string
`guardrail_id` required	path	string

Responses

204 No Content
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

GET/api/v1/orgs/{organization_id}/iam/credential-report

Get Credential Report (getCredentialReport)

IAM action: iam:GetCredentialReport

Parameter	In	Type	Description
`organization_id` required	path	string

Responses

200 OK (CredentialReportOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of CredentialReportOut

Field	Type	Description
`generated_at`	string (date-time)
`organization_id`	string
`principals`	array of ReportPrincipalOut
`unused_key_disable_days`	integer (nullable)

GET/api/v1/orgs/{organization_id}/iam/settings

Get Iam Settings (getIamSettings)

IAM action: iam:GetIamSettings

Parameter	In	Type	Description
`organization_id` required	path	string

Responses

200 OK (IamSettingsOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of IamSettingsOut

Field	Type	Description
`access_key_default_ttl_days`	integer
`access_key_max_ttl_days`	integer
`unused_key_disable_days`	integer (nullable)

PUT/api/v1/orgs/{organization_id}/iam/settings

Update Iam Settings (updateIamSettings)

IAM action: iam:UpdateIamSettings

Parameter	In	Type	Description
`organization_id` required	path	string

Request body (JSON, IamSettingsIn)

Field	Type	Description
`unused_key_disable_days` required	integer (nullable)

Responses

200 OK (IamSettingsOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of IamSettingsOut

Field	Type	Description
`access_key_default_ttl_days`	integer
`access_key_max_ttl_days`	integer
`unused_key_disable_days`	integer (nullable)

POST/api/v1/orgs/{organization_id}/iam/simulate

Simulate Principal Policy (simulatePrincipalPolicy)

Would a principal be allowed? Decides every action on every resource with the same evaluator as live requests and names the deciding layer and statements. Needs iam:SimulatePrincipalPolicy on the principal and read access to it (iam:DescribeUser, iam:DescribeServiceAccount or iam:DescribeRole).

IAM action: iam:SimulatePrincipalPolicyiam:DescribeUseriam:DescribeServiceAccountiam:DescribeRole

Parameter	In	Type	Description
`organization_id` required	path	string

Request body (JSON, SimulateIn)

Field	Type	Description
`actions` required	array of string	Actions to check, e.g. compute:StartVM (no wildcards).
`context`	object	Request keys to simulate: auth:mfa, auth:source-ip, auth:current-time, auth:epoch-time, auth:credential-type, and request:, iam:, resource:* keys (resource:tag/<key> stands in for the resource's tags). Keys describing the principal or the resource are ignored.
`principal` required	string	TRN of a user, service account, role or role session in this organization.
`resources` required	array of string	Resource TRNs in this organization; '<type>/*' checks a create.
`session_policy`	object (nullable)	Roles only: a session policy, as if passed to AssumeRole.

Responses

200 OK (SimulateOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of SimulateOut

Field	Type	Description
`ignored_context_keys`	array of string
`principal`	string
`results`	array of SimulationResultOut

GET/api/v1/orgs/{organization_id}/permission-boundaries

List Permission Boundaries (listPermissionBoundaries)

Boundaries in the organization; filter by principal (TRN).

IAM action: iam:DescribePermissionBoundary

Parameter	In	Type
`organization_id` required	path	string
`principal`	query	string (nullable)
`limit`	query	integer (nullable)
`cursor`	query	string (nullable)

Responses

200 OK (Page_PermissionBoundaryOut_)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of Page_PermissionBoundaryOut_

Field	Type	Description
`items`	array of PermissionBoundaryOut
`next_cursor`	string (nullable)

PUT/api/v1/orgs/{organization_id}/permission-boundaries

Put Permission Boundary (putPermissionBoundary)

Set or replace a principal's permission boundary: their identity policies then only grant what the boundary also allows. Repeating the same request changes nothing.

IAM action: iam:PutPermissionBoundary

Parameter	In	Type	Description
`organization_id` required	path	string

Request body (JSON, PermissionBoundaryIn)

Field	Type	Description
`policy` required	string	Policy ID, TRN or name: the organization's or a managed one.
`principal` required	string	TRN of a user, service account or role in this organization.

Responses

200 OK (PermissionBoundaryOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of PermissionBoundaryOut

Field	Type	Description
`created_at`	string (date-time)
`created_by`	string
`id`	string
`policy_id`	string
`policy_name`	string
`policy_trn`	string
`principal`	string
`principal_type`	string

DELETE/api/v1/orgs/{organization_id}/permission-boundaries/{boundary_id}

Delete Permission Boundary (deletePermissionBoundary)

IAM action: iam:DeletePermissionBoundary

Parameter	In	Type	Description
`organization_id` required	path	string
`boundary_id` required	path	string

Responses

204 No Content
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

GET/api/v1/orgs/{organization_id}/policies

List Policies (listPolicies)

scope: all, local (this organization's) or managed (TebibHost's).

IAM action: iam:DescribePolicy

Parameter	In	Type
`organization_id` required	path	string
`scope`	query	string
`limit`	query	integer (nullable)
`cursor`	query	string (nullable)

Responses

200 OK (Page_PolicyOut_)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of Page_PolicyOut_

Field	Type	Description
`items`	array of PolicyOut
`next_cursor`	string (nullable)

POST/api/v1/orgs/{organization_id}/policies

Create Policy (createPolicy)

IAM action: iam:CreatePolicy

Parameter	In	Type	Description
`organization_id` required	path	string

Request body (JSON, PolicyIn)

Field	Type	Description
`description`	string	Default: `""`.
`document` required	object
`name` required	string

Responses

201 Created (PolicyDetailOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of PolicyDetailOut

Field	Type	Description
`attachment_count`	integer
`created_at`	string (date-time)
`default_version`	integer
`description`	string
`document`	object
`id`	string
`managed`	boolean
`name`	string
`trn`	string
`updated_at`	string (date-time)

GET/api/v1/orgs/{organization_id}/policies/{policy_ref}

Get Policy (getPolicy)

policy_ref: a policy ID or name (TebibHost-managed policies by name, e.g. ReadOnly).

IAM action: iam:DescribePolicy

Parameter	In	Type	Description
`organization_id` required	path	string
`policy_ref` required	path	string

Responses

200 OK (PolicyDetailOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of PolicyDetailOut

Field	Type	Description
`attachment_count`	integer
`created_at`	string (date-time)
`default_version`	integer
`description`	string
`document`	object
`id`	string
`managed`	boolean
`name`	string
`trn`	string
`updated_at`	string (date-time)

PATCH/api/v1/orgs/{organization_id}/policies/{policy_ref}

Update Policy (updatePolicy)

IAM action: iam:UpdatePolicy

Parameter	In	Type	Description
`organization_id` required	path	string
`policy_ref` required	path	string

Request body (JSON, PolicyPatch)

Field	Type	Description
`description`	string (nullable)

Responses

200 OK (PolicyDetailOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of PolicyDetailOut

Field	Type	Description
`attachment_count`	integer
`created_at`	string (date-time)
`default_version`	integer
`description`	string
`document`	object
`id`	string
`managed`	boolean
`name`	string
`trn`	string
`updated_at`	string (date-time)

DELETE/api/v1/orgs/{organization_id}/policies/{policy_ref}

Delete Policy (deletePolicy)

IAM action: iam:DeletePolicy

Parameter	In	Type	Description
`organization_id` required	path	string
`policy_ref` required	path	string

Responses

204 No Content
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

PUT/api/v1/orgs/{organization_id}/policies/{policy_ref}/default-version

Set Default Policy Version (setDefaultPolicyVersion)

IAM action: iam:SetDefaultPolicyVersion

Parameter	In	Type	Description
`organization_id` required	path	string
`policy_ref` required	path	string

Request body (JSON, DefaultVersionIn)

Field	Type	Description
`version` required	integer

Responses

200 OK (PolicyDetailOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of PolicyDetailOut

Field	Type	Description
`attachment_count`	integer
`created_at`	string (date-time)
`default_version`	integer
`description`	string
`document`	object
`id`	string
`managed`	boolean
`name`	string
`trn`	string
`updated_at`	string (date-time)

GET/api/v1/orgs/{organization_id}/policies/{policy_ref}/versions

List Policy Versions (listPolicyVersions)

IAM action: iam:DescribePolicy

Parameter	In	Type	Description
`organization_id` required	path	string
`policy_ref` required	path	string

Responses

200 OK (array of VersionOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

POST/api/v1/orgs/{organization_id}/policies/{policy_ref}/versions

Create Policy Version (createPolicyVersion)

IAM action: iam:CreatePolicyVersion

Parameter	In	Type	Description
`organization_id` required	path	string
`policy_ref` required	path	string

Request body (JSON, VersionIn)

Field	Type	Description
`document` required	object
`set_as_default`	boolean	Default: `true`.

Responses

201 Created (VersionOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of VersionOut

Field	Type	Description
`created_at`	string (date-time)
`created_by`	string
`document`	object
`is_default`	boolean
`version`	integer

GET/api/v1/orgs/{organization_id}/policies/{policy_ref}/versions/{version}

Get Policy Version (getPolicyVersion)

IAM action: iam:DescribePolicy

Parameter	In	Type
`organization_id` required	path	string
`policy_ref` required	path	string
`version` required	path	integer

Responses

200 OK (VersionOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of VersionOut

Field	Type	Description
`created_at`	string (date-time)
`created_by`	string
`document`	object
`is_default`	boolean
`version`	integer

DELETE/api/v1/orgs/{organization_id}/policies/{policy_ref}/versions/{version}

Delete Policy Version (deletePolicyVersion)

IAM action: iam:DeletePolicyVersion

Parameter	In	Type
`organization_id` required	path	string
`policy_ref` required	path	string
`version` required	path	integer

Responses

204 No Content
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

GET/api/v1/orgs/{organization_id}/policy-attachments

List Attachments (listAttachments)

Filter by principal (TRN) and/or policy (ID, TRN or name).

IAM action: iam:DescribePolicyAttachment

Parameter	In	Type
`organization_id` required	path	string
`principal`	query	string (nullable)
`policy`	query	string (nullable)
`limit`	query	integer (nullable)
`cursor`	query	string (nullable)

Responses

200 OK (Page_PolicyAttachmentOut_)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of Page_PolicyAttachmentOut_

Field	Type	Description
`items`	array of PolicyAttachmentOut
`next_cursor`	string (nullable)

POST/api/v1/orgs/{organization_id}/policy-attachments

Create Attachment (createAttachment)

IAM action: iam:AttachUserPolicyiam:AttachGroupPolicyiam:AttachServiceAccountPolicyiam:AttachRolePolicy

Parameter	In	Type	Description
`organization_id` required	path	string

Request body (JSON, PolicyAttachmentIn)

Field	Type	Description
`policy` required	string
`principal` required	string
`project_id`	string (nullable)

Responses

201 Created (PolicyAttachmentOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of PolicyAttachmentOut

Field	Type	Description
`created_at`	string (date-time)
`created_by`	string
`id`	string
`policy_id`	string
`policy_trn`	string
`principal`	string
`principal_type`	string
`project_id`	string (nullable)

DELETE/api/v1/orgs/{organization_id}/policy-attachments/{attachment_id}

Delete Attachment (deleteAttachment)

IAM action: iam:DetachUserPolicyiam:DetachGroupPolicyiam:DetachServiceAccountPolicyiam:DetachRolePolicy

Parameter	In	Type	Description
`organization_id` required	path	string
`attachment_id` required	path	string

Responses

204 No Content
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

GET/api/v1/orgs/{organization_id}/roles

List Roles (listRoles)

IAM action: iam:DescribeRole

Parameter	In	Type
`organization_id` required	path	string
`limit`	query	integer (nullable)
`cursor`	query	string (nullable)

Responses

200 OK (Page_RoleOut_)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of Page_RoleOut_

Field	Type	Description
`items`	array of RoleOut
`next_cursor`	string (nullable)

POST/api/v1/orgs/{organization_id}/roles

Create Role (createRole)

IAM action: iam:CreateRole

Parameter	In	Type	Description
`organization_id` required	path	string

Request body (JSON, RoleIn)

Field	Type	Description
`description`	string	Default: `""`.
`max_session_seconds`	integer	Default: `3600`.
`name` required	string
`tags`	object
`trust_policy` required	object

Responses

201 Created (RoleOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of RoleOut

Field	Type	Description
`created_at`	string (date-time)
`description`	string
`id`	string
`max_session_seconds`	integer
`name`	string
`tags`	object
`trn`	string
`trust_policy`	object
`updated_at`	string (date-time)

GET/api/v1/orgs/{organization_id}/roles/{role_id}

Get Role (getRole)

IAM action: iam:DescribeRole

Parameter	In	Type	Description
`organization_id` required	path	string
`role_id` required	path	string

Responses

200 OK (RoleOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of RoleOut

Field	Type	Description
`created_at`	string (date-time)
`description`	string
`id`	string
`max_session_seconds`	integer
`name`	string
`tags`	object
`trn`	string
`trust_policy`	object
`updated_at`	string (date-time)

PATCH/api/v1/orgs/{organization_id}/roles/{role_id}

Update Role (updateRole)

IAM action: iam:UpdateRole

Parameter	In	Type	Description
`organization_id` required	path	string
`role_id` required	path	string

Request body (JSON, RolePatch)

Field	Type	Description
`description`	string (nullable)
`max_session_seconds`	integer (nullable)
`tags`	object (nullable)
`trust_policy`	object (nullable)

Responses

200 OK (RoleOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of RoleOut

Field	Type	Description
`created_at`	string (date-time)
`description`	string
`id`	string
`max_session_seconds`	integer
`name`	string
`tags`	object
`trn`	string
`trust_policy`	object
`updated_at`	string (date-time)

DELETE/api/v1/orgs/{organization_id}/roles/{role_id}

Delete Role (deleteRole)

IAM action: iam:DeleteRole

Parameter	In	Type	Description
`organization_id` required	path	string
`role_id` required	path	string

Responses

204 No Content
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

POST/api/v1/orgs/{organization_id}/roles/{role_id}/assume

Assume Role (assumeRole)

Temporary credentials for the role. Needs iam:AssumeRole on the role in the caller's policies AND the role's trust policy to allow the caller.

IAM action: iam:AssumeRole

Parameter	In	Type	Description
`organization_id` required	path	string
`role_id` required	path	string

Request body (JSON, AssumeRoleIn)

Field	Type	Description
`duration_seconds`	integer (nullable)
`policy`	object (nullable)
`session_name` required	string

Responses

200 OK (CredentialsOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of CredentialsOut

Field	Type	Description
`access_key_id`	string
`expires_at`	string (date-time)
`role_trn`	string
`secret`	string
`session_id`	string
`session_trn`	string
`token`	string

POST/api/v1/orgs/{organization_id}/roles/{role_id}/revoke-sessions

Revoke Role Sessions (revokeRoleSessions)

End every active session of the role now.

IAM action: iam:RevokeRoleSessions

Parameter	In	Type	Description
`organization_id` required	path	string
`role_id` required	path	string

Responses

200 OK (RevokedOut)
400 Invalid request (ErrorOut)
401 Not authenticated (ErrorOut)
403 Access denied: the error names the action and the resource (ErrorOut)
404 Not found (also: the resource belongs to another organization) (ErrorOut)
409 Conflict or quota exceeded (ErrorOut)
422 Idempotency key reused for a different request (ErrorOut)
429 Rate limited (ErrorOut)

Fields of RevokedOut

Field	Type	Description
`revoked`	integer