Amazon IAM Identity Center Iam Identity Center Identity Store API

openapi: 3.2.0
info:
  title: AWS Single Sign-On Admin Identity Store API
  version: '2020-07-20'
  description: Generated from AWS's published Smithy model for AWS Single Sign-On Admin. 3 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://identitystore.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Identity Store
paths:
  /#DescribeIdentityStore:
    post:
      operationId: DescribeIdentityStore
      summary: Describe Identity Store
      description: Retrieves details about the specified identity store, including its Amazon Resource Name (ARN) and network configuration.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DescribeIdentityStoreResponse'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreResourceNotFoundException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreValidationException'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreAccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreInternalServerException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreThrottlingException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWSIdentityStore.DescribeIdentityStore
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DescribeIdentityStoreRequest'
      tags:
      - Identity Store
  /#UpdateIdentityStore:
    post:
      operationId: UpdateIdentityStore
      summary: Update Identity Store
      description: Updates the configuration of the specified identity store, including its network configuration.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/UpdateIdentityStoreResponse'
        '409':
          description: ConflictException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreConflictException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreResourceNotFoundException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreValidationException'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreAccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreInternalServerException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreThrottlingException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWSIdentityStore.UpdateIdentityStore
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/UpdateIdentityStoreRequest'
      tags:
      - Identity Store
  /#ListIdentityStores:
    post:
      operationId: ListIdentityStores
      summary: List Identity Stores
      description: Lists the identity stores that you have access to. This operation returns only the identity store ID and Amazon Resource Name (ARN) of each identity store. To obtain additional information about an identity store, call DescribeIdentityStore. This operation returns results in paginated form. Use the NextToken parameter to retrieve additional pages of results.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ListIdentityStoresResponse'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreValidationException'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreAccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreInternalServerException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/IdentitystoreThrottlingException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWSIdentityStore.ListIdentityStores
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ListIdentityStoresRequest'
      tags:
      - Identity Store
components:
  schemas:
    NetworkConfiguration:
      type: object
      properties:
        VpceAccessRequired:
          type: boolean
          description: Specifies whether the identity store can be accessed only through a virtual private cloud (VPC) endpoint. When set to true, requests must originate from a VPC endpoint. This value must be set to either true or false when you provide NetworkConfiguration in a request.
        ApiRestrictSourceVpcs:
          type: array
          items:
            type: string
          description: A list of virtual private cloud (VPC) IDs that are allowed to access the identity store API operations. A request is denied unless it originates from a VPC in this list, or from an IP address in ApiAllowSourceIps if you specified one. If you don't specify a value, access isn't restricted to specific VPCs, but the VPC endpoint requirement set by VpceAccessRequired still applies.
        ApiAllowSourceIps:
          type: array
          items:
            type: string
          description: 'A list of IP address CIDR ranges that are allowed to access the identity store API operations. A request from an IP address in this list bypasses the identity store''s other API network controls: it''s permitted even if it doesn''t come through a VPC endpoint required by VpceAccessRequired, and even if it doesn''t originate from a VPC in ApiRestrictSourceVpcs. If you don''t specify a value, no such IP address exception applies.'
        ScimAllowSourceIps:
          type: array
          items:
            type: string
          description: A list of IP address CIDR ranges that are allowed to access the identity store through the System for Cross-domain Identity Management (SCIM) protocol. Requests from IP addresses outside these ranges are denied. If you don't specify a value, SCIM requests remain subject to the identity store's other network controls, such as the VPC endpoint requirement set by VpceAccessRequired. For example, to allow SCIM traffic from the public internet while still requiring the identity store API operations to be accessed through a VPC endpoint, set VpceAccessRequired to true and set this value to 0.0.0.0/0
      required:
      - VpceAccessRequired
    DescribeIdentityStoreResponse:
      type: object
      properties:
        IdentityStoreId:
          type: string
          description: The globally unique identifier for the identity store.
        IdentityStoreArn:
          type: string
          description: The Amazon Resource Name (ARN) of the identity store. For example, arn:aws:identitystore::111122223333:identitystore/d-1234567890.
        NetworkConfiguration:
          $ref: '#/components/schemas/NetworkConfigurationDetails'
      required:
      - IdentityStoreId
      - IdentityStoreArn
    IdentityStore:
      type: object
      properties:
        IdentityStoreId:
          type: string
          description: The globally unique identifier for the identity store.
        IdentityStoreArn:
          type: string
          description: The Amazon Resource Name (ARN) of the identity store. For example, arn:aws:identitystore::111122223333:identitystore/d-1234567890.
      required:
      - IdentityStoreId
      - IdentityStoreArn
    DescribeIdentityStoreRequest:
      type: object
      properties:
        IdentityStoreId:
          type: string
          description: The globally unique identifier for the identity store. You can specify the identity store by ID or by Amazon Resource Name (ARN). For example, identity store ID d-1234567890 or identity store ARN arn:aws:identitystore::111122223333:identitystore/d-1234567890.
      required:
      - IdentityStoreId
    ListIdentityStoresResponse:
      type: object
      properties:
        IdentityStores:
          type: array
          items:
            $ref: '#/components/schemas/IdentityStore'
          description: A list of IdentityStore objects, each of which contains the identifiers for an identity store that you have access to.
        NextToken:
          type: string
          description: The pagination token used for the ListIdentityStores API operation. This value is generated by the identity store service. It is returned in the API response if the total results are more than the size of one page. This token is also returned when it is used in the API request to retrieve the next page of results.
      required:
      - IdentityStores
    ListIdentityStoresRequest:
      type: object
      properties:
        MaxResults:
          type: integer
          description: The maximum number of results to return per request. This parameter is used in all List operations to specify how many results to return on one page. If you don't specify a value, the operation uses a default page size.
        NextToken:
          type: string
          description: The pagination token used for the ListIdentityStores API operation. This value is generated by the identity store service. It is returned in the API response if the total results are more than the size of one page. This token is also returned when it is used in the API request to retrieve the next page of results.
    UpdateIdentityStoreResponse:
      type: object
      properties:
        IdentityStoreId:
          type: string
          description: The globally unique identifier for the identity store.
        IdentityStoreArn:
          type: string
          description: The Amazon Resource Name (ARN) of the identity store. For example, arn:aws:identitystore::111122223333:identitystore/d-1234567890.
      required:
      - IdentityStoreId
      - IdentityStoreArn
    IdentitystoreAccessDeniedException:
      type: object
      properties:
        Message:
          type: string
        RequestId:
          type: string
          description: The identifier for each request. This value is a globally unique ID that is generated by the identity store service for each sent request, and is then returned inside the exception if the request fails.
        Reason:
          type: string
          enum:
          - KMS_ACCESS_DENIED
          description: Indicates the reason for an access denial when returned by KMS while accessing a Customer Managed KMS key. For non-KMS access-denied errors, this field is not included.
    UpdateIdentityStoreRequest:
      type: object
      properties:
        IdentityStoreId:
          type: string
          description: The globally unique identifier for the identity store. You can specify the identity store by ID or by Amazon Resource Name (ARN). For example, identity store ID d-1234567890 or identity store ARN arn:aws:identitystore::111122223333:identitystore/d-1234567890.
        NetworkConfiguration:
          $ref: '#/components/schemas/NetworkConfiguration'
      required:
      - IdentityStoreId
    IdentitystoreConflictException:
      type: object
      properties:
        Message:
          type: string
        RequestId:
          type: string
          description: The identifier for each request. This value is a globally unique ID that is generated by the identity store service for each sent request, and is then returned inside the exception if the request fails.
        Reason:
          type: string
          enum:
          - UNIQUENESS_CONSTRAINT_VIOLATION
          - CONCURRENT_MODIFICATION
          description: Indicates the reason for a conflict error when the service is unable to access a Customer Managed KMS key. For non-KMS permission errors, this field is not included.
    IdentitystoreResourceNotFoundException:
      type: object
      properties:
        ResourceType:
          type: string
          enum:
          - GROUP
          - USER
          - IDENTITY_STORE
          - GROUP_MEMBERSHIP
          - RESOURCE_POLICY
          description: An enum object indicating the type of resource in the identity store service. Valid values include USER, GROUP, and IDENTITY_STORE.
        ResourceId:
          type: string
          description: The identifier for a resource in the identity store that can be used as UserId or GroupId. The format for ResourceId is either UUID or 1234567890-UUID, where UUID is a randomly generated value for each resource when it is created and 1234567890 represents the IdentityStoreId string value. In the case that the identity store is migrated from a legacy SSO identity store, the ResourceId for that identity store will be in the format of UUID. Otherwise, it will be in the 1234567890-UUID format.
        Reason:
          type: string
          enum:
          - KMS_KEY_NOT_FOUND
          description: Indicates the reason for a resource not found error when the service is unable to access a Customer Managed KMS key. For non-KMS permission errors, this field is not included.
        Message:
          type: string
        RequestId:
          type: string
          description: The identifier for each request. This value is a globally unique ID that is generated by the identity store service for each sent request, and is then returned inside the exception if the request fails.
    IdentitystoreValidationException:
      type: object
      properties:
        Message:
          type: string
        RequestId:
          type: string
          description: The identifier for each request. This value is a globally unique ID that is generated by the identity store service for each sent request, and is then returned inside the exception if the request fails.
        Reason:
          type: string
          enum:
          - KMS_INVALID_ARN
          - KMS_INVALID_KEY_USAGE
          - KMS_INVALID_STATE
          - KMS_DISABLED
          description: Indicates the reason for the validation error when the service is unable to access a Customer Managed KMS key. For non-KMS permission errors, this field is not included.
    NetworkConfigurationDetails:
      type: object
      properties:
        VpceAccessRequired:
          type: boolean
          description: Specifies whether the identity store can be accessed only through a virtual private cloud (VPC) endpoint. When set to true, requests must originate from a VPC endpoint.
        ApiRestrictSourceVpcs:
          type: array
          items:
            type: string
          description: A list of virtual private cloud (VPC) IDs that are allowed to access the identity store API operations. A request is denied unless it originates from a VPC in this list, or from an IP address in ApiAllowSourceIps if one is configured. If this field is empty, access isn't restricted to specific VPCs, but the VPC endpoint requirement from VpceAccessRequired still applies.
        ApiAllowSourceIps:
          type: array
          items:
            type: string
          description: 'A list of IP address CIDR ranges that are allowed to access the identity store API operations. A request from an IP address in this list bypasses the identity store''s other API network controls: it''s permitted even if it doesn''t come through a VPC endpoint required by VpceAccessRequired, and even if it doesn''t originate from a VPC in ApiRestrictSourceVpcs. If this field is empty, no such IP address exception applies.'
        ScimAllowSourceIps:
          type: array
          items:
            type: string
          description: A list of IP address CIDR ranges that are allowed to access the identity store through the System for Cross-domain Identity Management (SCIM) protocol. Requests from IP addresses outside these ranges are denied. If this field is empty, SCIM requests remain subject to the identity store's other network controls, such as the VPC endpoint requirement.
      required:
      - VpceAccessRequired
    IdentitystoreThrottlingException:
      type: object
      properties:
        Message:
          type: string
        RequestId:
          type: string
          description: The identifier for each request. This value is a globally unique ID that is generated by the identity store service for each sent request, and is then returned inside the exception if the request fails.
        RetryAfterSeconds:
          type: integer
          description: The number of seconds to wait before retrying the next request.
        Reason:
          type: string
          enum:
          - KMS_THROTTLING
          description: Indicates the reason for the throttling error when the service is unable to access a Customer Managed KMS key. For non-KMS permission errors, this field is not included.
    IdentitystoreInternalServerException:
      type: object
      properties:
        Message:
          type: string
        RequestId:
          type: string
          description: The identifier for each request. This value is a globally unique ID that is generated by the identity store service for each sent request, and is then returned inside the exception if the request fails.
        RetryAfterSeconds:
          type: integer
          description: The number of seconds to wait before retrying the next request.
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: identitystore
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/identitystore/service/2020-06-15/identitystore-2020-06-15.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)