Amazon GuardDuty Guardduty Administrator API
The Guardduty Administrator API from Amazon GuardDuty — 2 operation(s) for guardduty administrator.
The Guardduty Administrator API from Amazon GuardDuty — 2 operation(s) for guardduty administrator.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/amazon-guardduty:amazon-guardduty-administrator-api"
curl "https://apis.io/api/v1/apis?limit=25"
Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Amazon GuardDuty Administrator API
version: '2017-11-28'
description: Generated from AWS's published Smithy model for Amazon GuardDuty. 3 operation(s).
contact:
name: Amazon Web Services
url: https://aws.amazon.com/contact-us/
license:
name: Apache 2.0
identifier: Apache-2.0
url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://guardduty.{region}.amazonaws.com
variables:
region:
default: us-east-1
security:
- sigv4: []
tags:
- name: Administrator
paths:
/detector/{DetectorId}/administrator:
post:
operationId: AcceptAdministratorInvitation
summary: Accept Administrator Invitation
description: Accepts the invitation to be a member account and get monitored by a GuardDuty administrator account that sent the invitation.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/AcceptAdministratorInvitationResponse'
'400':
description: BadRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestException'
'500':
description: InternalServerErrorException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalServerErrorException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/AcceptAdministratorInvitationRequest'
tags:
- Administrator
get:
operationId: GetAdministratorAccount
summary: Get Administrator Account
description: 'Provides the details of the GuardDuty administrator account associated with the current GuardDuty member account. Based on the type of account that runs this API, the following list shows how the API behavior varies: When the GuardDuty administrator account runs this API, it will return success (HTTP 200) but no content. When a member account runs this API, it will return the details of the GuardDuty administrator account that is associated with this calling member account. When an individual account (not associated with an organization) runs this API, it will return success (HTTP 200) but no content.'
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/GetAdministratorAccountResponse'
'400':
description: BadRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestException'
'500':
description: InternalServerErrorException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalServerErrorException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/GetAdministratorAccountRequest'
tags:
- Administrator
/detector/{DetectorId}/administrator/disassociate:
post:
operationId: DisassociateFromAdministratorAccount
summary: Disassociate From Administrator Account
description: Disassociates the current GuardDuty member account from its administrator account. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty in a member account.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/DisassociateFromAdministratorAccountResponse'
'400':
description: BadRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestException'
'500':
description: InternalServerErrorException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalServerErrorException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/DisassociateFromAdministratorAccountRequest'
tags:
- Administrator
components:
schemas:
AcceptAdministratorInvitationRequest:
type: object
properties:
DetectorId:
type: string
description: The unique ID of the detector of the GuardDuty member account.
AdministratorId:
type: string
description: The account ID of the GuardDuty administrator account whose invitation you're accepting.
InvitationId:
type: string
description: The value that is used to validate the administrator account to the member account.
required:
- DetectorId
- AdministratorId
- InvitationId
InternalServerErrorException:
type: object
properties:
Message:
type: string
description: The error message.
Type:
type: string
description: The error type.
AcceptAdministratorInvitationResponse:
type: object
properties: {}
DisassociateFromAdministratorAccountResponse:
type: object
properties: {}
DisassociateFromAdministratorAccountRequest:
type: object
properties:
DetectorId:
type: string
description: The unique ID of the detector of the GuardDuty member account.
required:
- DetectorId
GetAdministratorAccountResponse:
type: object
properties:
Administrator:
$ref: '#/components/schemas/Administrator'
required:
- Administrator
Administrator:
type: object
properties:
AccountId:
type: string
description: The ID of the account used as the administrator account.
InvitationId:
type: string
description: The value that is used to validate the administrator account to the member account.
RelationshipStatus:
type: string
description: The status of the relationship between the administrator and member accounts.
InvitedAt:
type: string
description: The timestamp when the invitation was sent.
BadRequestException:
type: object
properties:
Message:
type: string
description: The error message.
Type:
type: string
description: The error type.
GetAdministratorAccountRequest:
type: object
properties:
DetectorId:
type: string
description: The unique ID of the detector of the GuardDuty member account.
required:
- DetectorId
securitySchemes:
sigv4:
type: apiKey
in: header
name: Authorization
description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
x-aws-sigv4:
signingName: guardduty
x-provenance:
method: harvested
publisher: Amazon Web Services
source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/guardduty/service/2017-11-28/guardduty-2017-11-28.json
note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)