Amazon GuardDuty

Amazon GuardDuty Admin API

The Admin API from Amazon GuardDuty — 3 operation(s) for admin.

Documentation GitHub OpenAPI

Operations 3

POST /admin/disable Amazon GuardDuty Disable Organization Admin Account #

POST /admin/enable Amazon GuardDuty Enable Organization Admin Account #

GET /admin Amazon GuardDuty List Organization Admin Accounts #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/amazon-guardduty-admin-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  version: '2017-11-28'
  x-release: v4
  title: Amazon GuardDuty Admin API
  description: 'Amazon GuardDuty is a continuous security monitoring service that analyzes and processes the following data sources: VPC flow logs, Amazon Web Services CloudTrail management event logs, CloudTrail S3 data event logs, EKS audit logs, DNS logs, and Amazon EBS volume data.'
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_twitter.com_awscloud_profile_image.png
    backgroundColor: '#FFFFFF'
  termsOfService: https://aws.amazon.com/service-terms/
  contact:
    name: Mike Ralphson
    email: mike.ralphson@gmail.com
    url: https://github.com/mermade/aws2openapi
    x-twitter: PermittedSoc
  license:
    name: Apache 2.0 License
    url: http://www.apache.org/licenses/
  x-providerName: amazonaws.com
  x-serviceName: guardduty
  x-aws-signingName: guardduty
  x-origin:
  - contentType: application/json
    url: https://raw.githubusercontent.com/aws/aws-sdk-js/master/apis/guardduty-2017-11-28.normal.json
    converter:
      url: https://github.com/mermade/aws2openapi
      version: 1.0.0
    x-apisguru-driver: external
  x-apiClientRegistration:
    url: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct
  x-apisguru-categories:
  - cloud
  x-preferred: true
servers:
- url: http://guardduty.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Amazon GuardDuty multi-region endpoint
- url: https://guardduty.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Amazon GuardDuty multi-region endpoint
- url: http://guardduty.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Amazon GuardDuty endpoint for China (Beijing) and China (Ningxia)
- url: https://guardduty.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Amazon GuardDuty endpoint for China (Beijing) and China (Ningxia)
security:
- hmac: []
tags:
- name: Admin
paths:
  /admin/disable:
    parameters:
    - $ref: '#/components/parameters/X-Amz-Content-Sha256'
    - $ref: '#/components/parameters/X-Amz-Date'
    - $ref: '#/components/parameters/X-Amz-Algorithm'
    - $ref: '#/components/parameters/X-Amz-Credential'
    - $ref: '#/components/parameters/X-Amz-Security-Token'
    - $ref: '#/components/parameters/X-Amz-Signature'
    - $ref: '#/components/parameters/X-Amz-SignedHeaders'
    post:
      operationId: DisableOrganizationAdminAccount
      description: Disables an Amazon Web Services account within the Organization as the GuardDuty delegated administrator.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DisableOrganizationAdminAccountResponse'
              examples:
                DisableOrganizationAdminAccount200Example:
                  summary: Default DisableOrganizationAdminAccount 200 response
                  x-microcks-default: true
                  value:
                    detectorId: abc123
                    format: DNS_LOGS
        '480':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
              examples:
                DisableOrganizationAdminAccount480Example:
                  summary: Default DisableOrganizationAdminAccount 480 response
                  x-microcks-default: true
                  value:
                    detectorId: abc123
                    format: DNS_LOGS
        '481':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
              examples:
                DisableOrganizationAdminAccount481Example:
                  summary: Default DisableOrganizationAdminAccount 481 response
                  x-microcks-default: true
                  value:
                    detectorId: abc123
                    format: DNS_LOGS
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - adminAccountId
              properties:
                adminAccountId:
                  description: The Amazon Web Services Account ID for the organizations account to be disabled as a GuardDuty delegated administrator.
                  type: string
      summary: Amazon GuardDuty Disable Organization Admin Account
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      tags:
      - Admin
  /admin/enable:
    parameters:
    - $ref: '#/components/parameters/X-Amz-Content-Sha256'
    - $ref: '#/components/parameters/X-Amz-Date'
    - $ref: '#/components/parameters/X-Amz-Algorithm'
    - $ref: '#/components/parameters/X-Amz-Credential'
    - $ref: '#/components/parameters/X-Amz-Security-Token'
    - $ref: '#/components/parameters/X-Amz-Signature'
    - $ref: '#/components/parameters/X-Amz-SignedHeaders'
    post:
      operationId: EnableOrganizationAdminAccount
      description: Enables an Amazon Web Services account within the organization as the GuardDuty delegated administrator.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EnableOrganizationAdminAccountResponse'
              examples:
                EnableOrganizationAdminAccount200Example:
                  summary: Default EnableOrganizationAdminAccount 200 response
                  x-microcks-default: true
                  value:
                    detectorId: abc123
                    format: DNS_LOGS
        '480':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
              examples:
                EnableOrganizationAdminAccount480Example:
                  summary: Default EnableOrganizationAdminAccount 480 response
                  x-microcks-default: true
                  value:
                    detectorId: abc123
                    format: DNS_LOGS
        '481':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
              examples:
                EnableOrganizationAdminAccount481Example:
                  summary: Default EnableOrganizationAdminAccount 481 response
                  x-microcks-default: true
                  value:
                    detectorId: abc123
                    format: DNS_LOGS
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - adminAccountId
              properties:
                adminAccountId:
                  description: The Amazon Web Services Account ID for the organization account to be enabled as a GuardDuty delegated administrator.
                  type: string
      summary: Amazon GuardDuty Enable Organization Admin Account
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      tags:
      - Admin
  /admin:
    parameters:
    - $ref: '#/components/parameters/X-Amz-Content-Sha256'
    - $ref: '#/components/parameters/X-Amz-Date'
    - $ref: '#/components/parameters/X-Amz-Algorithm'
    - $ref: '#/components/parameters/X-Amz-Credential'
    - $ref: '#/components/parameters/X-Amz-Security-Token'
    - $ref: '#/components/parameters/X-Amz-Signature'
    - $ref: '#/components/parameters/X-Amz-SignedHeaders'
    get:
      operationId: ListOrganizationAdminAccounts
      description: Lists the accounts configured as GuardDuty delegated administrators.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListOrganizationAdminAccountsResponse'
              examples:
                ListOrganizationAdminAccounts200Example:
                  summary: Default ListOrganizationAdminAccounts 200 response
                  x-microcks-default: true
                  value:
                    detectorId: abc123
                    format: DNS_LOGS
        '480':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
              examples:
                ListOrganizationAdminAccounts480Example:
                  summary: Default ListOrganizationAdminAccounts 480 response
                  x-microcks-default: true
                  value:
                    detectorId: abc123
                    format: DNS_LOGS
        '481':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
              examples:
                ListOrganizationAdminAccounts481Example:
                  summary: Default ListOrganizationAdminAccounts 481 response
                  x-microcks-default: true
                  value:
                    detectorId: abc123
                    format: DNS_LOGS
      parameters:
      - name: maxResults
        in: query
        required: false
        description: The maximum number of results to return in the response.
        schema:
          type: integer
          minimum: 1
          maximum: 50
      - name: nextToken
        in: query
        required: false
        description: A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the <code>NextToken</code> value returned from the previous request to continue listing results after the first page.
        schema:
          type: string
      - name: MaxResults
        in: query
        schema:
          type: string
        description: Pagination limit
        required: false
      - name: NextToken
        in: query
        schema:
          type: string
        description: Pagination token
        required: false
      summary: Amazon GuardDuty List Organization Admin Accounts
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      tags:
      - Admin
components:
  schemas:
    AdminAccount:
      type: object
      properties:
        AdminAccountId:
          allOf:
          - $ref: '#/components/schemas/String'
          - xml:
              name: adminAccountId
            description: The Amazon Web Services account ID for the account.
        AdminStatus:
          allOf:
          - $ref: '#/components/schemas/AdminStatus'
          - xml:
              name: adminStatus
            description: Indicates whether the account is enabled as the delegated administrator.
      description: The account within the organization specified as the GuardDuty delegated administrator.
    String:
      type: string
    BadRequestException: {}
    AdminAccounts:
      type: array
      items:
        $ref: '#/components/schemas/AdminAccount'
      minItems: 0
      maxItems: 1
    ListOrganizationAdminAccountsResponse:
      type: object
      properties:
        AdminAccounts:
          allOf:
          - $ref: '#/components/schemas/AdminAccounts'
          - xml:
              name: adminAccounts
            description: A list of accounts configured as GuardDuty delegated administrators.
        NextToken:
          allOf:
          - $ref: '#/components/schemas/String'
          - xml:
              name: nextToken
            description: The pagination parameter to be used on the next list operation to retrieve more items.
    InternalServerErrorException: {}
    AdminStatus:
      type: string
      enum:
      - ENABLED
      - DISABLE_IN_PROGRESS
      minLength: 1
      maxLength: 300
    DisableOrganizationAdminAccountResponse:
      type: object
      properties: {}
    EnableOrganizationAdminAccountResponse:
      type: object
      properties: {}
  parameters:
    X-Amz-Algorithm:
      name: X-Amz-Algorithm
      in: header
      schema:
        type: string
      required: false
    X-Amz-Content-Sha256:
      name: X-Amz-Content-Sha256
      in: header
      schema:
        type: string
      required: false
    X-Amz-Date:
      name: X-Amz-Date
      in: header
      schema:
        type: string
      required: false
    X-Amz-Credential:
      name: X-Amz-Credential
      in: header
      schema:
        type: string
      required: false
    X-Amz-SignedHeaders:
      name: X-Amz-SignedHeaders
      in: header
      schema:
        type: string
      required: false
    X-Amz-Signature:
      name: X-Amz-Signature
      in: header
      schema:
        type: string
      required: false
    X-Amz-Security-Token:
      name: X-Amz-Security-Token
      in: header
      schema:
        type: string
      required: false
  securitySchemes:
    hmac:
      type: apiKey
      name: Authorization
      in: header
      description: Amazon Signature authorization v4
      x-amazon-apigateway-authtype: awsSigv4
externalDocs:
  description: Amazon Web Services documentation
  url: https://docs.aws.amazon.com/guardduty/
x-hasEquivalentPaths: true

Amazon GuardDuty Admin API

Operations 3

Documentation

Specifications

Schemas & Data

Other Resources