Amazon IAM Access Keys API

openapi: 3.2.0
info:
  title: Amazon Iam Access Keys API
  version: '2010-05-08'
  description: 'Operations tagged Access Keys across 2 of this provider''s published API definitions: amazon-iam-openapi.yml, amazon-iam-access-keys-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://iam.amazonaws.com
  description: IAM API endpoint
- url: https://iam.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
tags:
- name: Access Keys
  description: Operations for managing IAM access keys
paths:
  /?Action=CreateAccessKey:
    get:
      operationId: CreateAccessKey
      summary: Amazon IAM Create a New Access Key
      description: Creates a new AWS secret access key and corresponding AWS access key ID for the specified user.
      parameters:
      - name: Action
        in: query
        required: true
        schema:
          type: string
          enum:
          - CreateAccessKey
      - name: Version
        in: query
        required: true
        schema:
          type: string
          default: '2010-05-08'
      - name: UserName
        in: query
        description: The name of the IAM user for the new key. If not specified, uses the calling user.
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/xml:
              schema:
                $ref: '#/components/schemas/CreateAccessKeyResponse'
        '400':
          description: LimitExceeded - Maximum number of access keys reached
      tags:
      - Access Keys
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - AWS4Auth: []
    post:
      operationId: post?Action=CreateAccessKey
      summary: Create Access Key
      description: Creates a new Amazon Web Services secret access key and corresponding Amazon Web Services access key ID for the specified user. The default status for new keys is Active. If you do not specify a user name, IAM determines the user name implicitly based on the Amazon Web Services access key ID signing the request. This operation works for access keys under the Amazon Web Services account. Consequently, you can use this operation to manage Amazon Web Services account root user credentials. This is true even if the Amazon Web Services account has no associated users. For information about quotas on the number of keys you can create, see IAM and STS quotas in the IAM User Guide. To ensure the security of your Amazon Web Services account, the secret access key is accessible only during key and user creation. You must save the key (for example, in a text file) if you want to be able to access it again. If a secret key is lost, you can delete the access keys for the associated user and then create new keys.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/CreateAccessKeyResponse_2'
              example:
                AccessKey:
                  UserName: Bob
                  Status: Active
                  CreateDate: '2015-03-09T18:39:23.411Z'
                  SecretAccessKey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY
                  AccessKeyId: AKIAIOSFODNN7EXAMPLE
        '409':
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/LimitExceededException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: CreateAccessKey
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/CreateAccessKeyRequest'
            example:
              UserName: Bob
      tags:
      - Access Keys
      security:
      - AWS4Auth: []
      x-operation-id-source: normalized
      x-operation-id-original: CreateAccessKey
    servers:
    - url: https://iam.amazonaws.com
      description: IAM API endpoint
  /?Action=ListAccessKeys:
    get:
      operationId: ListAccessKeys
      summary: Amazon IAM List Access Keys for a User
      description: Returns information about the access key IDs associated with the specified IAM user.
      parameters:
      - name: Action
        in: query
        required: true
        schema:
          type: string
          enum:
          - ListAccessKeys
      - name: Version
        in: query
        required: true
        schema:
          type: string
          default: '2010-05-08'
      - name: UserName
        in: query
        description: The name of the user.
        schema:
          type: string
      - name: Marker
        in: query
        schema:
          type: string
      - name: MaxItems
        in: query
        schema:
          type: integer
          minimum: 1
          maximum: 1000
      responses:
        '200':
          description: Successful response
          content:
            application/xml:
              schema:
                $ref: '#/components/schemas/ListAccessKeysResponse'
        '404':
          description: NoSuchEntity - User does not exist
      tags:
      - Access Keys
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - AWS4Auth: []
    post:
      operationId: post?Action=ListAccessKeys
      summary: List Access Keys
      description: Returns information about the access key IDs associated with the specified IAM user. If there is none, the operation returns an empty list. Although each user is limited to a small number of keys, you can still paginate the results using the MaxItems and Marker parameters. If the UserName is not specified, the user name is determined implicitly based on the Amazon Web Services access key ID used to sign the request. If a temporary access key is used, then UserName is required. If a long-term key is assigned to the user, then UserName is not required. This operation works for access keys under the Amazon Web Services account. If the Amazon Web Services account has no associated users, the root user returns it's own access key IDs by running this command. To ensure the security of your Amazon Web Services account, the secret access key is accessible only during key and user creation.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ListAccessKeysResponse_2'
              example:
                AccessKeyMetadata:
                - UserName: Alice
                  Status: Active
                  CreateDate: '2016-12-01T22:19:58Z'
                  AccessKeyId: AKIA111111111EXAMPLE
                - UserName: Alice
                  Status: Active
                  CreateDate: '2016-12-01T22:20:01Z'
                  AccessKeyId: AKIA222222222EXAMPLE
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: ListAccessKeys
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/ListAccessKeysRequest'
            example:
              UserName: Alice
      tags:
      - Access Keys
      security:
      - AWS4Auth: []
      x-operation-id-source: normalized
      x-operation-id-original: ListAccessKeys
    servers:
    - url: https://iam.amazonaws.com
      description: IAM API endpoint
  /?Action=DeleteAccessKey:
    get:
      operationId: DeleteAccessKey
      summary: Amazon IAM Delete an Access Key
      description: Deletes the access key pair associated with the specified IAM user.
      parameters:
      - name: Action
        in: query
        required: true
        schema:
          type: string
          enum:
          - DeleteAccessKey
      - name: Version
        in: query
        required: true
        schema:
          type: string
          default: '2010-05-08'
      - name: UserName
        in: query
        description: The name of the user whose access key you want to delete.
        schema:
          type: string
      - name: AccessKeyId
        in: query
        required: true
        description: The access key ID for the access key to delete.
        schema:
          type: string
      responses:
        '200':
          description: Successful response
        '404':
          description: NoSuchEntity - Access key does not exist
      tags:
      - Access Keys
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - AWS4Auth: []
    post:
      operationId: post?Action=DeleteAccessKey
      summary: Delete Access Key
      description: Deletes the access key pair associated with the specified IAM user. If you do not specify a user name, IAM determines the user name implicitly based on the Amazon Web Services access key ID signing the request. This operation works for access keys under the Amazon Web Services account. Consequently, you can use this operation to manage Amazon Web Services account root user credentials even if the Amazon Web Services account has no associated users.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                type: string
        '409':
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/LimitExceededException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: DeleteAccessKey
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/DeleteAccessKeyRequest'
            example:
              UserName: Bob
              AccessKeyId: AKIDPMS9RO4H3FEXAMPLE
      tags:
      - Access Keys
      security:
      - AWS4Auth: []
      x-operation-id-source: normalized
      x-operation-id-original: DeleteAccessKey
    servers:
    - url: https://iam.amazonaws.com
      description: IAM API endpoint
  /?Action=UpdateAccessKey:
    post:
      operationId: UpdateAccessKey
      summary: Update Access Key
      description: Changes the status of the specified access key from Active to Inactive, or vice versa. This operation can be used to disable a user's key as part of a key rotation workflow. If the UserName is not specified, the user name is determined implicitly based on the Amazon Web Services access key ID used to sign the request. If a temporary access key is used, then UserName is required. If a long-term key is assigned to the user, then UserName is not required. This operation works for access keys under the Amazon Web Services account. Consequently, you can use this operation to manage Amazon Web Services account root user credentials even if the Amazon Web Services account has no associated users. For information about rotating keys, see Managing keys and certificates in the IAM User Guide.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                type: string
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '409':
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/LimitExceededException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: UpdateAccessKey
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/UpdateAccessKeyRequest'
            example:
              UserName: Bob
              Status: Inactive
              AccessKeyId: AKIAIOSFODNN7EXAMPLE
      tags:
      - Access Keys
      security:
      - sigv4: []
    servers:
    - url: https://iam.{region}.amazonaws.com
      variables:
        region:
          default: us-east-1
components:
  schemas:
    AccessKey:
      type: object
      properties:
        UserName:
          type: string
          description: The name of the IAM user the access key is associated with.
        AccessKeyId:
          type: string
          description: The ID for this access key.
        Status:
          type: string
          enum:
          - Active
          - Inactive
          description: The status of the access key.
        SecretAccessKey:
          type: string
          description: The secret key used to sign requests. Only returned on creation.
        CreateDate:
          type: string
          format: date-time
          description: The date when the access key was created.
      required:
      - UserName
      - AccessKeyId
      - Status
    CreateAccessKeyResponse:
      type: object
      properties:
        CreateAccessKeyResult:
          type: object
          properties:
            AccessKey:
              $ref: '#/components/schemas/AccessKey'
    ListAccessKeysResponse:
      type: object
      properties:
        ListAccessKeysResult:
          type: object
          properties:
            AccessKeyMetadata:
              type: array
              items:
                $ref: '#/components/schemas/AccessKey'
            IsTruncated:
              type: boolean
            Marker:
              type: string
    AccessKey_2:
      type: object
      properties:
        UserName:
          type: string
          description: The name of the IAM user that the access key is associated with.
        AccessKeyId:
          type: string
          description: The ID for this access key.
        Status:
          type: string
          enum:
          - Active
          - Inactive
          - Expired
          description: The status of the access key. Active means that the key is valid for API calls, while Inactive means it is not.
        SecretAccessKey:
          type: string
          description: The secret key used to sign requests.
        CreateDate:
          type: string
          format: date-time
          description: The date when the access key was created.
      required:
      - UserName
      - AccessKeyId
      - Status
      - SecretAccessKey
    DeleteAccessKeyRequest:
      type: object
      properties:
        UserName:
          type: string
          description: 'The name of the user whose access key pair you want to delete. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-'
        AccessKeyId:
          type: string
          description: The access key ID for the access key ID and secret access key you want to delete. This parameter allows (through its regex pattern) a string of characters that can consist of any upper or lowercased letter or digit.
      required:
      - AccessKeyId
    AccessKeyMetadata:
      type: object
      properties:
        UserName:
          type: string
          description: The name of the IAM user that the key is associated with.
        AccessKeyId:
          type: string
          description: The ID for this access key.
        Status:
          type: string
          enum:
          - Active
          - Inactive
          - Expired
          description: The status of the access key. Active means that the key is valid for API calls; Inactive means it is not.
        CreateDate:
          type: string
          format: date-time
          description: The date when the access key was created.
    ListAccessKeysRequest:
      type: object
      properties:
        UserName:
          type: string
          description: 'The name of the user. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-'
        Marker:
          type: string
          description: Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
        MaxItems:
          type: integer
          description: Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true. If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
    ListAccessKeysResponse_2:
      type: object
      properties:
        AccessKeyMetadata:
          type: array
          items:
            $ref: '#/components/schemas/AccessKeyMetadata'
          description: A list of objects containing metadata about the access keys.
        IsTruncated:
          type: boolean
          description: A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
        Marker:
          type: string
          description: When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
      required:
      - AccessKeyMetadata
    NoSuchEntityException:
      type: object
      properties:
        message:
          type: string
    CreateAccessKeyRequest:
      type: object
      properties:
        UserName:
          type: string
          description: 'The name of the IAM user that the new key will belong to. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-'
    InvalidInputException:
      type: object
      properties:
        message:
          type: string
    LimitExceededException:
      type: object
      properties:
        message:
          type: string
    UpdateAccessKeyRequest:
      type: object
      properties:
        UserName:
          type: string
          description: 'The name of the user whose key you want to update. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-'
        AccessKeyId:
          type: string
          description: The access key ID of the secret access key you want to update. This parameter allows (through its regex pattern) a string of characters that can consist of any upper or lowercased letter or digit.
        Status:
          type: string
          enum:
          - Active
          - Inactive
          - Expired
          description: The status you want to assign to the secret access key. Active means that the key can be used for programmatic calls to Amazon Web Services, while Inactive means that the key cannot be used.
      required:
      - AccessKeyId
      - Status
    CreateAccessKeyResponse_2:
      type: object
      properties:
        AccessKey:
          $ref: '#/components/schemas/AccessKey_2'
      required:
      - AccessKey
    ServiceFailureException:
      type: object
      properties:
        message:
          type: string
  securitySchemes:
    AWS4Auth:
      type: apiKey
      name: Authorization
      in: header
      description: AWS Signature Version 4 authentication
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: iam
x-refined-from:
- amazon-iam-openapi.yml
- amazon-iam-access-keys-api-openapi.yml