Amazon IAM Identity Center Iam Identity Center Application Grant API

openapi: 3.2.0
info:
  title: AWS Single Sign-On Admin Application Grant API
  version: '2020-07-20'
  description: Generated from AWS's published Smithy model for AWS Single Sign-On Admin. 4 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://sso.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Application Grant
paths:
  /#PutApplicationGrant:
    post:
      operationId: PutApplicationGrant
      summary: Put Application Grant
      description: 'Creates a configuration for an application to use grants. Conceptually grants are authorization to request actions related to tokens. This configuration will be used when parties are requesting and receiving tokens during the trusted identity propagation process. For more information on the IAM Identity Center supported grant workflows, see SAML 2.0 and OAuth 2.0. A grant is created between your applications and Identity Center instance which enables an application to use specified mechanisms to obtain tokens. These tokens are used by your applications to gain access to Amazon Web Services resources on behalf of users. The following elements are within these exchanges: Requester - The application requesting access to Amazon Web Services resources. Subject - Typically the user that is requesting access to Amazon Web Services resources. Grant - Conceptually, a grant is authorization to access Amazon Web Services resources. These grants authorize token generation for authenticating access to the requester and for the request to make requests on behalf of the subjects. There are four types of grants: AuthorizationCode - Allows an application to request authorization through a series of'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: ConflictException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.PutApplicationGrant
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/PutApplicationGrantRequest'
      tags:
      - Application Grant
  /#GetApplicationGrant:
    post:
      operationId: GetApplicationGrant
      summary: Get Application Grant
      description: Retrieves details about an application grant.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/GetApplicationGrantResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.GetApplicationGrant
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/GetApplicationGrantRequest'
      tags:
      - Application Grant
  /#DeleteApplicationGrant:
    post:
      operationId: DeleteApplicationGrant
      summary: Delete Application Grant
      description: Deletes a grant from an application.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: ConflictException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.DeleteApplicationGrant
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DeleteApplicationGrantRequest'
      tags:
      - Application Grant
  /#ListApplicationGrants:
    post:
      operationId: ListApplicationGrants
      summary: List Application Grants
      description: List the grants associated with an application.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ListApplicationGrantsResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.ListApplicationGrants
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ListApplicationGrantsRequest'
      tags:
      - Application Grant
components:
  schemas:
    GetApplicationGrantResponse:
      type: object
      properties:
        Grant:
          $ref: '#/components/schemas/Grant'
      required:
      - Grant
    TokenExchangeGrant:
      type: object
      properties: {}
    ListApplicationGrantsRequest:
      type: object
      properties:
        ApplicationArn:
          type: string
          description: Specifies the ARN of the application whose grants you want to list.
        NextToken:
          type: string
          description: Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.
      required:
      - ApplicationArn
    ValidationException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_InvalidKeyUsageException
          - KMS_InvalidStateException
          - KMS_DisabledException
          description: The reason for the validation exception.
    Grant:
      type: object
      properties:
        AuthorizationCode:
          $ref: '#/components/schemas/AuthorizationCodeGrant'
        JwtBearer:
          $ref: '#/components/schemas/JwtBearerGrant'
        RefreshToken:
          $ref: '#/components/schemas/RefreshTokenGrant'
        TokenExchange:
          $ref: '#/components/schemas/TokenExchangeGrant'
      description: Exactly one member is set.
    AccessDeniedException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_AccessDeniedException
          description: The reason for the access denied exception.
    JwtBearerGrant:
      type: object
      properties:
        AuthorizedTokenIssuers:
          type: array
          items:
            $ref: '#/components/schemas/AuthorizedTokenIssuer'
          description: A list of allowed token issuers trusted by the Identity Center instances for this application. AuthorizedTokenIssuers is required when the grant type is JwtBearerGrant.
    GrantItem:
      type: object
      properties:
        GrantType:
          type: string
          enum:
          - authorization_code
          - refresh_token
          - urn:ietf:params:oauth:grant-type:jwt-bearer
          - urn:ietf:params:oauth:grant-type:token-exchange
          description: The type of the selected grant.
        Grant:
          $ref: '#/components/schemas/Grant'
      required:
      - GrantType
      - Grant
    GetApplicationGrantRequest:
      type: object
      properties:
        ApplicationArn:
          type: string
          description: Specifies the ARN of the application that contains the grant.
        GrantType:
          type: string
          enum:
          - authorization_code
          - refresh_token
          - urn:ietf:params:oauth:grant-type:jwt-bearer
          - urn:ietf:params:oauth:grant-type:token-exchange
          description: Specifies the type of grant.
      required:
      - ApplicationArn
      - GrantType
    ResourceNotFoundException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_NotFoundException
          description: The reason for the resource not found exception.
    ConflictException:
      type: object
      properties:
        Message:
          type: string
    PutApplicationGrantRequest:
      type: object
      properties:
        ApplicationArn:
          type: string
          description: Specifies the ARN of the application to update.
        GrantType:
          type: string
          enum:
          - authorization_code
          - refresh_token
          - urn:ietf:params:oauth:grant-type:jwt-bearer
          - urn:ietf:params:oauth:grant-type:token-exchange
          description: Specifies the type of grant to update.
        Grant:
          $ref: '#/components/schemas/Grant'
      required:
      - ApplicationArn
      - GrantType
      - Grant
    AuthorizedTokenIssuer:
      type: object
      properties:
        TrustedTokenIssuerArn:
          type: string
          description: The ARN of the trusted token issuer.
        AuthorizedAudiences:
          type: array
          items:
            type: string
          description: An array list of authorized audiences, or applications, that can consume the tokens generated by the associated trusted token issuer.
    DeleteApplicationGrantRequest:
      type: object
      properties:
        ApplicationArn:
          type: string
          description: Specifies the ARN of the application with the grant to delete.
        GrantType:
          type: string
          enum:
          - authorization_code
          - refresh_token
          - urn:ietf:params:oauth:grant-type:jwt-bearer
          - urn:ietf:params:oauth:grant-type:token-exchange
          description: Specifies the type of grant to delete from the application.
      required:
      - ApplicationArn
      - GrantType
    ListApplicationGrantsResponse:
      type: object
      properties:
        Grants:
          type: array
          items:
            $ref: '#/components/schemas/GrantItem'
          description: An array list of structures that describe the requested grants.
        NextToken:
          type: string
          description: If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.
      required:
      - Grants
    AuthorizationCodeGrant:
      type: object
      properties:
        RedirectUris:
          type: array
          items:
            type: string
          description: A list of URIs that are valid locations to redirect a user's browser after the user is authorized. RedirectUris is required when the grant type is authorization_code.
    RefreshTokenGrant:
      type: object
      properties: {}
    ThrottlingException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_ThrottlingException
          description: The reason for the throttling exception.
    InternalServerException:
      type: object
      properties:
        Message:
          type: string
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: sso
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/sso-admin/service/2020-07-20/sso-admin-2020-07-20.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)