Amazon IAM Identity Center Iam Identity Center Instance API

openapi: 3.2.0
info:
  title: AWS Single Sign-On Admin Instance API
  version: '2020-07-20'
  description: Generated from AWS's published Smithy model for AWS Single Sign-On Admin. 4 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://sso.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Instance
paths:
  /#CreateInstance:
    post:
      operationId: CreateInstance
      summary: Create Instance
      description: 'Creates an instance of IAM Identity Center for a standalone Amazon Web Services account that is not managed by Organizations or a member Amazon Web Services account in an organization. You can create only one instance per account and across all Amazon Web Services Regions. The CreateInstance request is rejected if the following apply: The instance is created within the organization management account. An instance already exists in the same account.'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/CreateInstanceResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: ConflictException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '402':
          description: ServiceQuotaExceededException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ServiceQuotaExceededException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.CreateInstance
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/CreateInstanceRequest'
      tags:
      - Instance
  /#DeleteInstance:
    post:
      operationId: DeleteInstance
      summary: Delete Instance
      description: Deletes the instance of IAM Identity Center. Only the account that owns the instance can call this API. Neither the delegated administrator nor member account can delete the organization instance, but those roles can delete their own instance.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DeleteInstanceResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: ConflictException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.DeleteInstance
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DeleteInstanceRequest'
      tags:
      - Instance
  /#DescribeInstance:
    post:
      operationId: DescribeInstance
      summary: Describe Instance
      description: 'Returns the details of an instance of IAM Identity Center. The status can be one of the following: CREATE_IN_PROGRESS - The instance is in the process of being created. When the instance is ready for use, DescribeInstance returns the status of ACTIVE. While the instance is in the CREATE_IN_PROGRESS state, you can call only DescribeInstance and DeleteInstance operations. DELETE_IN_PROGRESS - The instance is being deleted. Returns AccessDeniedException after the delete operation completes. ACTIVE - The instance is active.'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DescribeInstanceResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.DescribeInstance
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DescribeInstanceRequest'
      tags:
      - Instance
  /#UpdateInstance:
    post:
      operationId: UpdateInstance
      summary: Update Instance
      description: 'Update the details for the instance of IAM Identity Center that is owned by the Amazon Web Services account. In a single UpdateInstance request, you can perform only one of the following operations: Update the encryption configuration of the instance by specifying EncryptionConfiguration. Enable permission sets for the instance by specifying PermissionSetsEnabled. If you specify both EncryptionConfiguration and PermissionSetsEnabled in a request, the request returns a ValidationException. To perform both operations, call UpdateInstance separately for each. You can make the two calls in parallel.'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/UpdateInstanceResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: ConflictException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.UpdateInstance
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/UpdateInstanceRequest'
      tags:
      - Instance
components:
  schemas:
    ValidationException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_InvalidKeyUsageException
          - KMS_InvalidStateException
          - KMS_DisabledException
          description: The reason for the validation exception.
    AccessDeniedException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_AccessDeniedException
          description: The reason for the access denied exception.
    UpdateInstanceResponse:
      type: object
      properties: {}
    CreateInstanceRequest:
      type: object
      properties:
        Name:
          type: string
          description: The name of the instance of IAM Identity Center.
        ClientToken:
          type: string
          description: Specifies a unique, case-sensitive ID that you provide to ensure the idempotency of the request. This lets you safely retry the request without accidentally performing the same operation a second time. Passing the same value to a later call to an operation requires that you also pass the same value for all other parameters. We recommend that you use a UUID type of value. If you don't provide this value, then Amazon Web Services generates a random one for you. If you retry the operation with the same ClientToken, but with different parameters, the retry fails with an IdempotentParameterMismatch
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: Specifies tags to be attached to the instance of IAM Identity Center.
    ResourceNotFoundException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_NotFoundException
          description: The reason for the resource not found exception.
    ConflictException:
      type: object
      properties:
        Message:
          type: string
    CreateInstanceResponse:
      type: object
      properties:
        InstanceArn:
          type: string
          description: The ARN of the instance of IAM Identity Center under which the operation will run. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.
    DeleteInstanceRequest:
      type: object
      properties:
        InstanceArn:
          type: string
          description: The ARN of the instance of IAM Identity Center under which the operation will run.
      required:
      - InstanceArn
    DeleteInstanceResponse:
      type: object
      properties: {}
    Tag:
      type: object
      properties:
        Key:
          type: string
          description: The key for the tag.
        Value:
          type: string
          description: The value of the tag.
      required:
      - Key
      - Value
    RegionMetadata:
      type: object
      properties:
        RegionName:
          type: string
          description: The Amazon Web Services Region name.
        Status:
          type: string
          enum:
          - ACTIVE
          - ADDING
          - REMOVING
          description: The current status of the Region. Valid values are ACTIVE (Region is operational), ADDING (Region extension workflow is in progress), or REMOVING (Region removal workflow is in progress).
        AddedDate:
          type: string
          format: date-time
          description: The timestamp when the Region was added to the IAM Identity Center instance. For the primary Region, this is the instance creation time.
        IsPrimaryRegion:
          type: boolean
          description: Indicates whether this is the primary Region where the IAM Identity Center instance was originally enabled. The primary Region cannot be removed.
    UpdateInstanceRequest:
      type: object
      properties:
        Name:
          type: string
          description: Updates the instance name.
        InstanceArn:
          type: string
          description: The ARN of the instance of IAM Identity Center under which the operation will run. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.
        EncryptionConfiguration:
          $ref: '#/components/schemas/EncryptionConfiguration'
        PermissionSetsEnabled:
          type: boolean
          description: Enables permission sets for this Identity Center instance. The only accepted value is true . After permission sets are enabled, they cannot be disabled. You can't set EncryptionConfiguration and PermissionSetsEnabled in the same request. To configure both, make two separate UpdateInstance calls. You can make these calls in parallel.
      required:
      - InstanceArn
    EncryptionConfigurationDetails:
      type: object
      properties:
        KeyType:
          type: string
          enum:
          - AWS_OWNED_KMS_KEY
          - CUSTOMER_MANAGED_KEY
          description: The type of KMS key used for encryption.
        KmsKeyArn:
          type: string
          description: The ARN of the KMS key currently used to encrypt data in your IAM Identity Center instance.
        EncryptionStatus:
          type: string
          enum:
          - UPDATING
          - ENABLED
          - UPDATE_FAILED
          description: The current status of encryption configuration.
        EncryptionStatusReason:
          type: string
          description: Provides additional context about the current encryption status. This field is particularly useful when the encryption status is UPDATE_FAILED. When encryption configuration update fails, this field contains information about the cause, which may include KMS key access issues, key not found errors, invalid key configuration, key in an invalid state, or a disabled key.
    ServiceQuotaExceededException:
      type: object
      properties:
        Message:
          type: string
    EncryptionConfiguration:
      type: object
      properties:
        KeyType:
          type: string
          enum:
          - AWS_OWNED_KMS_KEY
          - CUSTOMER_MANAGED_KEY
          description: The type of KMS key used for encryption.
        KmsKeyArn:
          type: string
          description: The ARN of the KMS key used to encrypt data. Required when KeyType is CUSTOMER_MANAGED_KEY. Cannot be specified when KeyType is AWS_OWNED_KMS_KEY.
      required:
      - KeyType
    ThrottlingException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_ThrottlingException
          description: The reason for the throttling exception.
    DescribeInstanceRequest:
      type: object
      properties:
        InstanceArn:
          type: string
          description: The ARN of the instance of IAM Identity Center under which the operation will run.
      required:
      - InstanceArn
    DescribeInstanceResponse:
      type: object
      properties:
        InstanceArn:
          type: string
          description: The ARN of the instance of IAM Identity Center under which the operation will run. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.
        IdentityStoreId:
          type: string
          description: The identifier of the identity store that is connected to the instance of IAM Identity Center.
        IdentityStoreArn:
          type: string
          description: The ARN of the identity store that is connected to the instance of IAM Identity Center.
        OwnerAccountId:
          type: string
          description: The identifier of the Amazon Web Services account for which the instance was created.
        Name:
          type: string
          description: Specifies the instance name.
        CreatedDate:
          type: string
          format: date-time
          description: The date the instance was created.
        Status:
          type: string
          enum:
          - CREATE_IN_PROGRESS
          - CREATE_FAILED
          - DELETE_IN_PROGRESS
          - ACTIVE
          description: The status of the instance.
        StatusReason:
          type: string
          description: Provides additional context about the current status of the IAM Identity Center instance. This field is particularly useful when an instance is in a non-ACTIVE state, such as CREATE_FAILED. When an instance fails to create or update, this field contains information about the cause, which may include issues with KMS key configuration, permission problems with the specified KMS key, or service-related errors.
        PrimaryRegion:
          type: string
          description: The primary Region where the IAM Identity Center instance was originally enabled. The primary Region cannot be removed.
        Regions:
          type: array
          items:
            $ref: '#/components/schemas/RegionMetadata'
          description: The list of Regions enabled in the IAM Identity Center instance, including Regions with ACTIVE, ADDING, or REMOVING status.
        EncryptionConfigurationDetails:
          $ref: '#/components/schemas/EncryptionConfigurationDetails'
        PermissionSetsEnabled:
          type: boolean
          description: Indicates whether permission sets are enabled for this Identity Center instance.
    InternalServerException:
      type: object
      properties:
        Message:
          type: string
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: sso
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/sso-admin/service/2020-07-20/sso-admin-2020-07-20.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)