Amazon IAM Identity Center Iam Identity Center Trusted Token Issuer API

openapi: 3.2.0
info:
  title: AWS Single Sign-On Admin Trusted Token Issuer API
  version: '2020-07-20'
  description: Generated from AWS's published Smithy model for AWS Single Sign-On Admin. 5 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://sso.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Trusted Token Issuer
paths:
  /#CreateTrustedTokenIssuer:
    post:
      operationId: CreateTrustedTokenIssuer
      summary: Create Trusted Token Issuer
      description: Creates a connection to a trusted token issuer in an instance of IAM Identity Center. A trusted token issuer enables trusted identity propagation to be used with applications that authenticate outside of Amazon Web Services. This trusted token issuer describes an external identity provider (IdP) that can generate claims or assertions in the form of access tokens for a user. Applications enabled for IAM Identity Center can use these tokens for authentication.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/CreateTrustedTokenIssuerResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: ConflictException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '402':
          description: ServiceQuotaExceededException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ServiceQuotaExceededException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.CreateTrustedTokenIssuer
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/CreateTrustedTokenIssuerRequest'
      tags:
      - Trusted Token Issuer
  /#DeleteTrustedTokenIssuer:
    post:
      operationId: DeleteTrustedTokenIssuer
      summary: Delete Trusted Token Issuer
      description: Deletes a trusted token issuer configuration from an instance of IAM Identity Center. Deleting this trusted token issuer configuration will cause users to lose access to any applications that are configured to use the trusted token issuer.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DeleteTrustedTokenIssuerResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: ConflictException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.DeleteTrustedTokenIssuer
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DeleteTrustedTokenIssuerRequest'
      tags:
      - Trusted Token Issuer
  /#DescribeTrustedTokenIssuer:
    post:
      operationId: DescribeTrustedTokenIssuer
      summary: Describe Trusted Token Issuer
      description: Retrieves details about a trusted token issuer configuration stored in an instance of IAM Identity Center. Details include the name of the trusted token issuer, the issuer URL, and the path of the source attribute and the destination attribute for a trusted token issuer configuration.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DescribeTrustedTokenIssuerResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.DescribeTrustedTokenIssuer
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DescribeTrustedTokenIssuerRequest'
      tags:
      - Trusted Token Issuer
  /#ListTrustedTokenIssuers:
    post:
      operationId: ListTrustedTokenIssuers
      summary: List Trusted Token Issuers
      description: Lists all the trusted token issuers configured in an instance of IAM Identity Center.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ListTrustedTokenIssuersResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.ListTrustedTokenIssuers
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ListTrustedTokenIssuersRequest'
      tags:
      - Trusted Token Issuer
  /#UpdateTrustedTokenIssuer:
    post:
      operationId: UpdateTrustedTokenIssuer
      summary: Update Trusted Token Issuer
      description: Updates the name of the trusted token issuer, or the path of a source attribute or destination attribute for a trusted token issuer configuration. Updating this trusted token issuer configuration might cause users to lose access to any applications that are configured to use the trusted token issuer.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/UpdateTrustedTokenIssuerResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: ConflictException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ValidationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SWBExternalService.UpdateTrustedTokenIssuer
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/UpdateTrustedTokenIssuerRequest'
      tags:
      - Trusted Token Issuer
components:
  schemas:
    ValidationException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_InvalidKeyUsageException
          - KMS_InvalidStateException
          - KMS_DisabledException
          description: The reason for the validation exception.
    AccessDeniedException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_AccessDeniedException
          description: The reason for the access denied exception.
    DescribeTrustedTokenIssuerResponse:
      type: object
      properties:
        TrustedTokenIssuerArn:
          type: string
          description: The ARN of the trusted token issuer configuration.
        Name:
          type: string
          description: The name of the trusted token issuer configuration.
        TrustedTokenIssuerType:
          type: string
          enum:
          - OIDC_JWT
          description: The type of the trusted token issuer.
        TrustedTokenIssuerConfiguration:
          $ref: '#/components/schemas/TrustedTokenIssuerConfiguration'
    UpdateTrustedTokenIssuerRequest:
      type: object
      properties:
        TrustedTokenIssuerArn:
          type: string
          description: Specifies the ARN of the trusted token issuer configuration that you want to update.
        Name:
          type: string
          description: Specifies the updated name to be applied to the trusted token issuer configuration.
        TrustedTokenIssuerConfiguration:
          $ref: '#/components/schemas/TrustedTokenIssuerUpdateConfiguration'
      required:
      - TrustedTokenIssuerArn
    ResourceNotFoundException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_NotFoundException
          description: The reason for the resource not found exception.
    OidcJwtUpdateConfiguration:
      type: object
      properties:
        ClaimAttributePath:
          type: string
          description: The path of the source attribute in the JWT from the trusted token issuer. The attribute mapped by this JMESPath expression is compared against the attribute mapped by IdentityStoreAttributePath when a trusted token issuer token is exchanged for an IAM Identity Center token.
        IdentityStoreAttributePath:
          type: string
          description: The path of the destination attribute in a JWT from IAM Identity Center. The attribute mapped by this JMESPath expression is compared against the attribute mapped by ClaimAttributePath when a trusted token issuer token is exchanged for an IAM Identity Center token.
        JwksRetrievalOption:
          type: string
          enum:
          - OPEN_ID_DISCOVERY
          description: The method that the trusted token issuer can use to retrieve the JSON Web Key Set used to verify a JWT.
    OidcJwtConfiguration:
      type: object
      properties:
        IssuerUrl:
          type: string
          description: The URL that IAM Identity Center uses for OpenID Discovery. OpenID Discovery is used to obtain the information required to verify the tokens that the trusted token issuer generates.
        ClaimAttributePath:
          type: string
          description: The path of the source attribute in the JWT from the trusted token issuer. The attribute mapped by this JMESPath expression is compared against the attribute mapped by IdentityStoreAttributePath when a trusted token issuer token is exchanged for an IAM Identity Center token.
        IdentityStoreAttributePath:
          type: string
          description: The path of the destination attribute in a JWT from IAM Identity Center. The attribute mapped by this JMESPath expression is compared against the attribute mapped by ClaimAttributePath when a trusted token issuer token is exchanged for an IAM Identity Center token.
        JwksRetrievalOption:
          type: string
          enum:
          - OPEN_ID_DISCOVERY
          description: The method that the trusted token issuer can use to retrieve the JSON Web Key Set used to verify a JWT.
      required:
      - IssuerUrl
      - ClaimAttributePath
      - IdentityStoreAttributePath
      - JwksRetrievalOption
    ConflictException:
      type: object
      properties:
        Message:
          type: string
    ListTrustedTokenIssuersResponse:
      type: object
      properties:
        TrustedTokenIssuers:
          type: array
          items:
            $ref: '#/components/schemas/TrustedTokenIssuerMetadata'
          description: An array list of the trusted token issuer configurations.
        NextToken:
          type: string
          description: If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.
    DeleteTrustedTokenIssuerRequest:
      type: object
      properties:
        TrustedTokenIssuerArn:
          type: string
          description: Specifies the ARN of the trusted token issuer configuration to delete.
      required:
      - TrustedTokenIssuerArn
    TrustedTokenIssuerMetadata:
      type: object
      properties:
        TrustedTokenIssuerArn:
          type: string
          description: The ARN of the trusted token issuer configuration in the instance of IAM Identity Center.
        Name:
          type: string
          description: The name of the trusted token issuer configuration in the instance of IAM Identity Center.
        TrustedTokenIssuerType:
          type: string
          enum:
          - OIDC_JWT
          description: The type of trusted token issuer.
    DeleteTrustedTokenIssuerResponse:
      type: object
      properties: {}
    Tag:
      type: object
      properties:
        Key:
          type: string
          description: The key for the tag.
        Value:
          type: string
          description: The value of the tag.
      required:
      - Key
      - Value
    ServiceQuotaExceededException:
      type: object
      properties:
        Message:
          type: string
    CreateTrustedTokenIssuerRequest:
      type: object
      properties:
        InstanceArn:
          type: string
          description: Specifies the ARN of the instance of IAM Identity Center to contain the new trusted token issuer configuration.
        Name:
          type: string
          description: Specifies the name of the new trusted token issuer configuration.
        TrustedTokenIssuerType:
          type: string
          enum:
          - OIDC_JWT
          description: Specifies the type of the new trusted token issuer.
        TrustedTokenIssuerConfiguration:
          $ref: '#/components/schemas/TrustedTokenIssuerConfiguration'
        ClientToken:
          type: string
          description: Specifies a unique, case-sensitive ID that you provide to ensure the idempotency of the request. This lets you safely retry the request without accidentally performing the same operation a second time. Passing the same value to a later call to an operation requires that you also pass the same value for all other parameters. We recommend that you use a UUID type of value.. If you don't provide this value, then Amazon Web Services generates a random one for you. If you retry the operation with the same ClientToken, but with different parameters, the retry fails with an IdempotentParameterMismatc
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: Specifies tags to be attached to the new trusted token issuer configuration.
      required:
      - InstanceArn
      - Name
      - TrustedTokenIssuerType
      - TrustedTokenIssuerConfiguration
    ListTrustedTokenIssuersRequest:
      type: object
      properties:
        InstanceArn:
          type: string
          description: Specifies the ARN of the instance of IAM Identity Center with the trusted token issuer configurations that you want to list.
        MaxResults:
          type: integer
          description: Specifies the total number of results that you want included in each response. If additional items exist beyond the number you specify, the NextToken response element is returned with a value (not null). Include the specified value as the NextToken request parameter in the next call to the operation to get the next set of results. Note that the service might return fewer results than the maximum even when there are more results available. You should check NextToken after every operation to ensure that you receive all of the results.
        NextToken:
          type: string
          description: Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.
      required:
      - InstanceArn
    DescribeTrustedTokenIssuerRequest:
      type: object
      properties:
        TrustedTokenIssuerArn:
          type: string
          description: Specifies the ARN of the trusted token issuer configuration that you want details about.
      required:
      - TrustedTokenIssuerArn
    ThrottlingException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - KMS_ThrottlingException
          description: The reason for the throttling exception.
    UpdateTrustedTokenIssuerResponse:
      type: object
      properties: {}
    CreateTrustedTokenIssuerResponse:
      type: object
      properties:
        TrustedTokenIssuerArn:
          type: string
          description: The ARN of the new trusted token issuer configuration.
    InternalServerException:
      type: object
      properties:
        Message:
          type: string
    TrustedTokenIssuerUpdateConfiguration:
      type: object
      properties:
        OidcJwtConfiguration:
          $ref: '#/components/schemas/OidcJwtUpdateConfiguration'
      description: Exactly one member is set.
    TrustedTokenIssuerConfiguration:
      type: object
      properties:
        OidcJwtConfiguration:
          $ref: '#/components/schemas/OidcJwtConfiguration'
      description: Exactly one member is set.
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: sso
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/sso-admin/service/2020-07-20/sso-admin-2020-07-20.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)