Amazon Connect Security Profiles API

openapi: 3.1.0
info:
  title: Amazon Connect Service Security Profiles API
  version: '2017-08-08'
  description: Generated from AWS's published Smithy model for Amazon Connect Service. 5 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://connect.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
paths:
  /security-profiles/{InstanceId}:
    put:
      operationId: CreateSecurityProfile
      summary: Create Security Profile
      description: Creates a security profile. For information about security profiles, see Security Profiles in the Connect
        Customer Administrator Guide. For a mapping of the API name and user interface name of the security profile permissions,
        see List of security profile permissions.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateSecurityProfileResponse'
        '409':
          description: DuplicateResourceException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DuplicateResourceException'
        '500':
          description: InternalServiceException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServiceException'
        '400':
          description: InvalidParameterException; InvalidRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '429':
          description: LimitExceededException; ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LimitExceededException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSecurityProfileRequest'
      tags:
      - Security Profiles
  /security-profiles/{InstanceId}/{SecurityProfileId}:
    delete:
      operationId: DeleteSecurityProfile
      summary: Delete Security Profile
      description: Deletes a security profile.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: string
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalServiceException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServiceException'
        '400':
          description: InvalidParameterException; InvalidRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '409':
          description: ResourceInUseException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceInUseException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteSecurityProfileRequest'
      tags:
      - Security Profiles
    get:
      operationId: DescribeSecurityProfile
      summary: Describe Security Profile
      description: Gets basic information about the security profile. For information about security profiles, see Security
        Profiles in the Connect Customer Administrator Guide. For a mapping of the API name and user interface name of the
        security profile permissions, see List of security profile permissions.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DescribeSecurityProfileResponse'
        '500':
          description: InternalServiceException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServiceException'
        '400':
          description: InvalidParameterException; InvalidRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DescribeSecurityProfileRequest'
      tags:
      - Security Profiles
    post:
      operationId: UpdateSecurityProfile
      summary: Update Security Profile
      description: Updates a security profile. For information about security profiles, see Security Profiles in the Connect
        Customer Administrator Guide. For a mapping of the API name and user interface name of the security profile permissions,
        see List of security profile permissions.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: string
        '500':
          description: InternalServiceException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServiceException'
        '400':
          description: InvalidParameterException; InvalidRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateSecurityProfileRequest'
      tags:
      - Security Profiles
  /users/{InstanceId}/{UserId}/security-profiles:
    post:
      operationId: UpdateUserSecurityProfiles
      summary: Update User Security Profiles
      description: Assigns the specified security profiles to the specified user.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: string
        '500':
          description: InternalServiceException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServiceException'
        '400':
          description: InvalidParameterException; InvalidRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateUserSecurityProfilesRequest'
      tags:
      - Security Profiles
components:
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical
        request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: connect
  schemas:
    AIAgent:
      type: object
      properties:
        Arn:
          type: string
          description: The Amazon Resource Name (ARN) of the AI agent.
        Type:
          type: string
          enum:
          - THIRD_PARTY
          description: The type of the AI agent. The valid value is THIRD_PARTY.
    AccessDeniedException:
      type: object
      properties:
        Message:
          type: string
    Application:
      type: object
      properties:
        Namespace:
          type: string
          description: Namespace of the application that you want to give access to.
        ApplicationPermissions:
          type: array
          items:
            type: string
          description: The permissions that the agent is granted on the application. For third-party applications, only the
            ACCESS permission is supported. For MCP Servers, the permissions are tool Identifiers accepted by MCP Server.
        Type:
          type: string
          enum:
          - MCP
          - THIRD_PARTY_APPLICATION
          description: Type of Application.
    CreateSecurityProfileRequest:
      type: object
      properties:
        SecurityProfileName:
          type: string
          description: The name of the security profile.
        Description:
          type: string
          description: The description of the security profile.
        Permissions:
          type: array
          items:
            type: string
          description: Permissions assigned to the security profile. For a list of valid permissions, see List of security
            profile permissions.
        InstanceId:
          type: string
          description: The identifier of the Connect Customer instance. You can find the instance ID in the Amazon Resource
            Name (ARN) of the instance.
        Tags:
          type: object
          additionalProperties:
            type: string
          description: 'The tags used to organize, track, or control access for this resource. For example, { "Tags": {"key1":"value1",
            "key2":"value2"} }.'
        AllowedAccessControlTags:
          type: object
          additionalProperties:
            type: string
          description: The list of tags that a security profile uses to restrict access to resources in Connect Customer.
        TagRestrictedResources:
          type: array
          items:
            type: string
          description: The list of resources that a security profile applies tag restrictions to in Connect Customer. For
            a list of Connect Customer resources that you can tag, see Add tags to resources in Connect Customer in the Connect
            Customer Administrator Guide.
        Applications:
          type: array
          items:
            $ref: '#/components/schemas/Application'
          description: A list of third-party applications or MCP Servers that the security profile will give access to.
        HierarchyRestrictedResources:
          type: array
          items:
            type: string
          description: 'The list of resources that a security profile applies hierarchy restrictions to in Connect Customer.
            Following are acceptable ResourceNames: User.'
        AllowedAccessControlHierarchyGroupId:
          type: string
          description: The identifier of the hierarchy group that a security profile uses to restrict access to resources
            in Connect Customer.
        AllowedFlowModules:
          type: array
          items:
            $ref: '#/components/schemas/FlowModule'
          description: A list of Flow Modules an AI Agent can invoke as a tool.
        AllowedAIAgents:
          type: array
          items:
            $ref: '#/components/schemas/AIAgent'
          description: A list of AI agents that the security profile will give access to.
        GranularAccessControlConfiguration:
          $ref: '#/components/schemas/GranularAccessControlConfiguration'
      required:
      - SecurityProfileName
      - InstanceId
    CreateSecurityProfileResponse:
      type: object
      properties:
        SecurityProfileId:
          type: string
          description: The identifier for the security profle.
        SecurityProfileArn:
          type: string
          description: The Amazon Resource Name (ARN) for the security profile.
    DataTableAccessControlConfiguration:
      type: object
      properties:
        PrimaryAttributeAccessControlConfiguration:
          $ref: '#/components/schemas/PrimaryAttributeAccessControlConfigurationItem'
    DeleteSecurityProfileRequest:
      type: object
      properties:
        InstanceId:
          type: string
          description: The identifier of the Connect Customer instance. You can find the instance ID in the Amazon Resource
            Name (ARN) of the instance.
        SecurityProfileId:
          type: string
          description: The identifier for the security profle.
      required:
      - InstanceId
      - SecurityProfileId
    DescribeSecurityProfileRequest:
      type: object
      properties:
        SecurityProfileId:
          type: string
          description: The identifier for the security profle.
        InstanceId:
          type: string
          description: The identifier of the Connect Customer instance. You can find the instance ID in the Amazon Resource
            Name (ARN) of the instance.
      required:
      - SecurityProfileId
      - InstanceId
    DescribeSecurityProfileResponse:
      type: object
      properties:
        SecurityProfile:
          $ref: '#/components/schemas/SecurityProfile'
    DuplicateResourceException:
      type: object
      properties:
        Message:
          type: string
    FlowModule:
      type: object
      properties:
        Type:
          type: string
          enum:
          - MCP
          description: Only Type we support is MCP.
        FlowModuleId:
          type: string
          description: If of Flow Modules invocable as tool
    GranularAccessControlConfiguration:
      type: object
      properties:
        DataTableAccessControlConfiguration:
          $ref: '#/components/schemas/DataTableAccessControlConfiguration'
    InternalServiceException:
      type: object
      properties:
        Message:
          type: string
          description: The message.
    InvalidParameterException:
      type: object
      properties:
        Message:
          type: string
          description: The message about the parameters.
    LimitExceededException:
      type: object
      properties:
        Message:
          type: string
          description: The message about the limit.
    PrimaryAttributeAccessControlConfigurationItem:
      type: object
      properties:
        PrimaryAttributeValues:
          type: array
          items:
            $ref: '#/components/schemas/PrimaryAttributeValue'
          description: The item's primary attribute values.
    PrimaryAttributeValue:
      type: object
      properties:
        AccessType:
          type: string
          enum:
          - ALLOW
          description: The value's access type.
        AttributeName:
          type: string
          description: The value's attribute name.
        Values:
          type: array
          items:
            type: string
          description: The value's values.
    ResourceInUseException:
      type: object
      properties:
        Message:
          type: string
        ResourceType:
          type: string
          enum:
          - CONTACT
          - CONTACT_FLOW
          - INSTANCE
          - PARTICIPANT
          - HIERARCHY_LEVEL
          - HIERARCHY_GROUP
          - USER
          - PHONE_NUMBER
          description: The type of resource.
        ResourceId:
          type: string
          description: The identifier for the resource.
    ResourceNotFoundException:
      type: object
      properties:
        Message:
          type: string
          description: The message about the resource.
    SecurityProfile:
      type: object
      properties:
        Id:
          type: string
          description: The identifier for the security profile.
        OrganizationResourceId:
          type: string
          description: The organization resource identifier for the security profile.
        Arn:
          type: string
          description: The Amazon Resource Name (ARN) for the security profile.
        SecurityProfileName:
          type: string
          description: The name for the security profile.
        Description:
          type: string
          description: The description of the security profile.
        Tags:
          type: object
          additionalProperties:
            type: string
          description: 'The tags used to organize, track, or control access for this resource. For example, { "Tags": {"key1":"value1",
            "key2":"value2"} }.'
        AllowedAccessControlTags:
          type: object
          additionalProperties:
            type: string
          description: The list of tags that a security profile uses to restrict access to resources in Connect Customer.
        TagRestrictedResources:
          type: array
          items:
            type: string
          description: The list of resources that a security profile applies tag restrictions to in Connect Customer.
        LastModifiedTime:
          type: string
          format: date-time
          description: The timestamp when this resource was last modified.
        LastModifiedRegion:
          type: string
          description: The Amazon Web Services Region where this resource was last modified.
        HierarchyRestrictedResources:
          type: array
          items:
            type: string
          description: 'The list of resources that a security profile applies hierarchy restrictions to in Connect Customer.
            Following are acceptable ResourceNames: User.'
        AllowedAccessControlHierarchyGroupId:
          type: string
          description: The identifier of the hierarchy group that a security profile uses to restrict access to resources
            in Connect Customer.
        GranularAccessControlConfiguration:
          $ref: '#/components/schemas/GranularAccessControlConfiguration'
        Type:
          type: string
          enum:
          - AWS_MANAGED
          - CUSTOMER_MANAGED
          description: 'The type of the security profile: AWS_MANAGED or CUSTOMER_MANAGED.'
    ThrottlingException:
      type: object
      properties:
        Message:
          type: string
    UpdateSecurityProfileRequest:
      type: object
      properties:
        Description:
          type: string
          description: The description of the security profile.
        Permissions:
          type: array
          items:
            type: string
          description: The permissions granted to a security profile. For a list of valid permissions, see List of security
            profile permissions.
        SecurityProfileId:
          type: string
          description: The identifier for the security profle.
        InstanceId:
          type: string
          description: The identifier of the Connect Customer instance. You can find the instance ID in the Amazon Resource
            Name (ARN) of the instance.
        AllowedAccessControlTags:
          type: object
          additionalProperties:
            type: string
          description: The list of tags that a security profile uses to restrict access to resources in Connect Customer.
        TagRestrictedResources:
          type: array
          items:
            type: string
          description: The list of resources that a security profile applies tag restrictions to in Connect Customer.
        Applications:
          type: array
          items:
            $ref: '#/components/schemas/Application'
          description: A list of the third-party application's metadata.
        HierarchyRestrictedResources:
          type: array
          items:
            type: string
          description: 'The list of resources that a security profile applies hierarchy restrictions to in Connect Customer.
            Following are acceptable ResourceNames: User.'
        AllowedAccessControlHierarchyGroupId:
          type: string
          description: The identifier of the hierarchy group that a security profile uses to restrict access to resources
            in Connect Customer.
        AllowedFlowModules:
          type: array
          items:
            $ref: '#/components/schemas/FlowModule'
          description: A list of Flow Modules an AI Agent can invoke as a tool
        AllowedAIAgents:
          type: array
          items:
            $ref: '#/components/schemas/AIAgent'
          description: A list of AI agents that the security profile will give access to.
        GranularAccessControlConfiguration:
          $ref: '#/components/schemas/GranularAccessControlConfiguration'
      required:
      - SecurityProfileId
      - InstanceId
    UpdateUserSecurityProfilesRequest:
      type: object
      properties:
        SecurityProfileIds:
          type: array
          items:
            type: string
          description: The identifiers of the security profiles for the user.
        UserId:
          type: string
          description: The identifier of the user account.
        InstanceId:
          type: string
          description: The identifier of the Connect Customer instance. You can find the instance ID in the Amazon Resource
            Name (ARN) of the instance.
      required:
      - SecurityProfileIds
      - UserId
      - InstanceId
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/connect/service/2017-08-08/connect-2017-08-08.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)