Amazon IAM Identity Center Iam Identity Center Application Assignment API

openapi: 3.2.0
info:
  title: AWS Single Sign-On Admin Application Assignment API
  version: '2020-07-20'
  description: Generated from AWS's published Smithy model for AWS Single Sign-On Admin. 5 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://sso.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Application Assignment
paths:
  /#CreateApplicationAssignment:
    post:
      operationId: CreateApplicationAssignment
      summary: Create Application Assignment
      description: Grant application access to a user or group.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/CreateApplicationAssignmentResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: ConflictException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '402':
          description: ServiceQuotaExceededException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ServiceQuotaExceededException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.CreateApplicationAssignment
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/CreateApplicationAssignmentRequest'
      tags:
      - Application Assignment
  /#DeleteApplicationAssignment:
    post:
      operationId: DeleteApplicationAssignment
      summary: Delete Application Assignment
      description: Revoke application access to an application by deleting application assignments for a user or group.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DeleteApplicationAssignmentResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: ConflictException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.DeleteApplicationAssignment
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DeleteApplicationAssignmentRequest'
      tags:
      - Application Assignment
  /#DescribeApplicationAssignment:
    post:
      operationId: DescribeApplicationAssignment
      summary: Describe Application Assignment
      description: Retrieves a direct assignment of a user or group to an application. If the user doesn’t have a direct assignment to the application, the user may still have access to the application through a group. Therefore, don’t use this API to test access to an application for a user. Instead use ListApplicationAssignmentsForPrincipal.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DescribeApplicationAssignmentResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.DescribeApplicationAssignment
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DescribeApplicationAssignmentRequest'
      tags:
      - Application Assignment
  /#ListApplicationAssignments:
    post:
      operationId: ListApplicationAssignments
      summary: List Application Assignments
      description: Lists Amazon Web Services account users that are assigned to an application.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ListApplicationAssignmentsResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.ListApplicationAssignments
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ListApplicationAssignmentsRequest'
      tags:
      - Application Assignment
  /#ListApplicationAssignmentsForPrincipal:
    post:
      operationId: ListApplicationAssignmentsForPrincipal
      summary: List Application Assignments For Principal
      description: Lists the applications to which a specified principal is assigned. You must provide a filter when calling this action from a member account against your organization instance of IAM Identity Center. A filter is not required when called from the management account against an organization instance of IAM Identity Center, or from a member account against an account instance of IAM Identity Center in the same account.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ListApplicationAssignmentsForPrincipalResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.ListApplicationAssignmentsForPrincipal
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ListApplicationAssignmentsForPrincipalRequest'
      tags:
      - Application Assignment
components:
  schemas:
    DescribeApplicationAssignmentResponse:
      type: object
      properties:
        PrincipalType:
          type: string
          enum:
          - USER
          - GROUP
          description: The entity type for which the assignment will be created.
        PrincipalId:
          type: string
          description: An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.
        ApplicationArn:
          type: string
          description: Specifies the ARN of the application. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.
    ValidationException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_InvalidKeyUsageException
          - KMS_InvalidStateException
          - KMS_DisabledException
          description: The reason for the validation exception.
    AccessDeniedException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_AccessDeniedException
          description: The reason for the access denied exception.
    ApplicationAssignmentForPrincipal:
      type: object
      properties:
        ApplicationArn:
          type: string
          description: The ARN of the application to which the specified principal is assigned.
        PrincipalId:
          type: string
          description: The unique identifier of the principal assigned to the application.
        PrincipalType:
          type: string
          enum:
          - USER
          - GROUP
          description: The type of the principal assigned to the application.
    CreateApplicationAssignmentResponse:
      type: object
      properties: {}
    ResourceNotFoundException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_NotFoundException
          description: The reason for the resource not found exception.
    DeleteApplicationAssignmentRequest:
      type: object
      properties:
        ApplicationArn:
          type: string
          description: Specifies the ARN of the application.
        PrincipalId:
          type: string
          description: An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.
        PrincipalType:
          type: string
          enum:
          - USER
          - GROUP
          description: The entity type for which the assignment will be deleted.
      required:
      - ApplicationArn
      - PrincipalId
      - PrincipalType
    ConflictException:
      type: object
      properties:
        Message:
          type: string
    CreateApplicationAssignmentRequest:
      type: object
      properties:
        ApplicationArn:
          type: string
          description: The ARN of the application for which the assignment is created.
        PrincipalId:
          type: string
          description: An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.
        PrincipalType:
          type: string
          enum:
          - USER
          - GROUP
          description: The entity type for which the assignment will be created.
      required:
      - ApplicationArn
      - PrincipalId
      - PrincipalType
    ApplicationAssignment:
      type: object
      properties:
        ApplicationArn:
          type: string
          description: The ARN of the application that has principals assigned.
        PrincipalId:
          type: string
          description: The unique identifier of the principal assigned to the application.
        PrincipalType:
          type: string
          enum:
          - USER
          - GROUP
          description: The type of the principal assigned to the application.
      required:
      - ApplicationArn
      - PrincipalId
      - PrincipalType
    ListApplicationAssignmentsForPrincipalRequest:
      type: object
      properties:
        InstanceArn:
          type: string
          description: Specifies the instance of IAM Identity Center that contains principal and applications.
        PrincipalId:
          type: string
          description: Specifies the unique identifier of the principal for which you want to retrieve its assignments.
        PrincipalType:
          type: string
          enum:
          - USER
          - GROUP
          description: Specifies the type of the principal for which you want to retrieve its assignments.
        Filter:
          $ref: '#/components/schemas/ListApplicationAssignmentsFilter'
        NextToken:
          type: string
          description: Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.
        MaxResults:
          type: integer
          description: Specifies the total number of results that you want included in each response. If additional items exist beyond the number you specify, the NextToken response element is returned with a value (not null). Include the specified value as the NextToken request parameter in the next call to the operation to get the next set of results. Note that the service might return fewer results than the maximum even when there are more results available. You should check NextToken after every operation to ensure that you receive all of the results.
      required:
      - InstanceArn
      - PrincipalId
      - PrincipalType
    ListApplicationAssignmentsFilter:
      type: object
      properties:
        ApplicationArn:
          type: string
          description: The ARN of an application.
    DescribeApplicationAssignmentRequest:
      type: object
      properties:
        ApplicationArn:
          type: string
          description: Specifies the ARN of the application. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.
        PrincipalId:
          type: string
          description: An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.
        PrincipalType:
          type: string
          enum:
          - USER
          - GROUP
          description: The entity type for which the assignment will be created.
      required:
      - ApplicationArn
      - PrincipalId
      - PrincipalType
    ListApplicationAssignmentsForPrincipalResponse:
      type: object
      properties:
        ApplicationAssignments:
          type: array
          items:
            $ref: '#/components/schemas/ApplicationAssignmentForPrincipal'
          description: An array list of the application assignments for the specified principal.
        NextToken:
          type: string
          description: If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.
    ServiceQuotaExceededException:
      type: object
      properties:
        Message:
          type: string
    ThrottlingException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_ThrottlingException
          description: The reason for the throttling exception.
    ListApplicationAssignmentsResponse:
      type: object
      properties:
        ApplicationAssignments:
          type: array
          items:
            $ref: '#/components/schemas/ApplicationAssignment'
          description: The list of users assigned to an application.
        NextToken:
          type: string
          description: If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.
    ListApplicationAssignmentsRequest:
      type: object
      properties:
        ApplicationArn:
          type: string
          description: Specifies the ARN of the application.
        MaxResults:
          type: integer
          description: Specifies the total number of results that you want included in each response. If additional items exist beyond the number you specify, the NextToken response element is returned with a value (not null). Include the specified value as the NextToken request parameter in the next call to the operation to get the next set of results. Note that the service might return fewer results than the maximum even when there are more results available. You should check NextToken after every operation to ensure that you receive all of the results.
        NextToken:
          type: string
          description: Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.
      required:
      - ApplicationArn
    InternalServerException:
      type: object
      properties:
        Message:
          type: string
    DeleteApplicationAssignmentResponse:
      type: object
      properties: {}
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: sso
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/sso-admin/service/2020-07-20/sso-admin-2020-07-20.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)