Amazon IAM Iam Delegation Request API

openapi: 3.2.0
info:
  title: AWS Identity and Access Management Delegation Request API
  version: '2010-05-08'
  description: Generated from AWS's published Smithy model for AWS Identity and Access Management. 7 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://iam.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Delegation Request
paths:
  /?Action=AcceptDelegationRequest:
    post:
      operationId: AcceptDelegationRequest
      summary: Accept Delegation Request
      description: Accepts a delegation request, granting the requested temporary access. Once the delegation request is accepted, it is eligible to send the exchange token to the partner. The SendDelegationToken API has to be explicitly called to send the delegation token. At the time of acceptance, IAM records the details and the state of the identity that called this API. This is the identity that gets mapped to the delegated credential. An accepted request may be rejected before the exchange token is sent to the partner.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                type: string
        '409':
          description: ConcurrentModificationException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ConcurrentModificationException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: AcceptDelegationRequest
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/AcceptDelegationRequestRequest'
      tags:
      - Delegation Request
  /?Action=AssociateDelegationRequest:
    post:
      operationId: AssociateDelegationRequest
      summary: Associate Delegation Request
      description: Associates a delegation request with the current identity. If the partner that created the delegation request has specified the owner account during creation, only an identity from that owner account can call the AssociateDelegationRequest API for the specified delegation request. Once the AssociateDelegationRequest API call is successful, the ARN of the current calling identity will be stored as the ownerId of the request. If the partner that created the delegation request has not specified the owner account during creation, any caller from any account can call the AssociateDelegationRequest API for the delegation request. Once this API call is successful, the ARN of the current calling identity will be stored as the ownerId and the Amazon Web Services account ID of the current calling identity will be stored as the ownerAccount of the request. For more details, see Managing Permissions for Delegation Requests.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                type: string
        '409':
          description: ConcurrentModificationException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ConcurrentModificationException'
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: AssociateDelegationRequest
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/AssociateDelegationRequestRequest'
      tags:
      - Delegation Request
  /?Action=CreateDelegationRequest:
    post:
      operationId: CreateDelegationRequest
      summary: Create Delegation Request
      description: Creates an IAM delegation request for temporary access delegation. This API is not available for general use. In order to use this API, a caller first need to go through an onboarding process described in the partner onboarding documentation.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/CreateDelegationRequestResponse'
        '409':
          description: ConcurrentModificationException; EntityAlreadyExistsException; LimitExceededException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ConcurrentModificationException'
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: CreateDelegationRequest
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/CreateDelegationRequestRequest'
      tags:
      - Delegation Request
  /?Action=GetDelegationRequest:
    post:
      operationId: GetDelegationRequest
      summary: Get Delegation Request
      description: Retrieves information about a specific delegation request. If a delegation request has no owner or owner account, GetDelegationRequest for that delegation request can be called by any account. If the owner account is assigned but there is no owner id, only identities within that owner account can call GetDelegationRequest for the delegation request. Once the delegation request is fully owned, the owner of the request gets a default permission to get that delegation request. For more details, see Managing Permissions for Delegation Requests.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/GetDelegationRequestResponse'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: GetDelegationRequest
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/GetDelegationRequestRequest'
      tags:
      - Delegation Request
  /?Action=ListDelegationRequests:
    post:
      operationId: ListDelegationRequests
      summary: List Delegation Requests
      description: Lists delegation requests based on the specified criteria. If a delegation request has no owner, even if it is assigned to a specific account, it will not be part of the ListDelegationRequests output for that account. For more details, see Managing Permissions for Delegation Requests.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ListDelegationRequestsResponse'
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: ListDelegationRequests
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/ListDelegationRequestsRequest'
      tags:
      - Delegation Request
  /?Action=RejectDelegationRequest:
    post:
      operationId: RejectDelegationRequest
      summary: Reject Delegation Request
      description: Rejects a delegation request, denying the requested temporary access. Once a request is rejected, it cannot be accepted or updated later. Rejected requests expire after 7 days. When rejecting a request, an optional explanation can be added using the Notes request parameter. For more details, see Managing Permissions for Delegation Requests.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                type: string
        '409':
          description: ConcurrentModificationException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ConcurrentModificationException'
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: RejectDelegationRequest
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/RejectDelegationRequestRequest'
      tags:
      - Delegation Request
  /?Action=UpdateDelegationRequest:
    post:
      operationId: UpdateDelegationRequest
      summary: Update Delegation Request
      description: Updates an existing delegation request with additional information. When the delegation request is updated, it reaches the PENDING_APPROVAL state. Once a delegation request has an owner, that owner gets a default permission to update the delegation request. For more details, see Managing Permissions for Delegation Requests.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                type: string
        '409':
          description: ConcurrentModificationException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ConcurrentModificationException'
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: UpdateDelegationRequest
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/UpdateDelegationRequestRequest'
      tags:
      - Delegation Request
components:
  schemas:
    ListDelegationRequestsRequest:
      type: object
      properties:
        OwnerId:
          type: string
          description: The owner ID to filter delegation requests by.
        Marker:
          type: string
          description: Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
        MaxItems:
          type: integer
          description: Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true. If you do not include this parameter, the number of items defaults to 100. Note that IAM may return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
    CreateDelegationRequestRequest:
      type: object
      properties:
        OwnerAccountId:
          type: string
          description: The Amazon Web Services account ID this delegation request is targeted to. If the account ID is not known, this parameter can be omitted, resulting in a request that can be associated by any account. If the account ID passed, then the created delegation request can only be associated with an identity of that target account.
        Description:
          type: string
          description: A description of the delegation request.
        Permissions:
          $ref: '#/components/schemas/DelegationPermission'
        RequestMessage:
          type: string
          description: A message explaining the reason for the delegation request. Requesters can utilize this field to add a custom note to the delegation request. This field is different from the description such that this is to be utilized for a custom messaging on a case-by-case basis. For example, if the current delegation request is in response to a previous request being rejected, this explanation can be added to the request via this field.
        RequestorWorkflowId:
          type: string
          description: The workflow ID associated with the requestor. This is the unique identifier on the partner side that can be used to track the progress of the request. IAM maintains a uniqueness check on this workflow id for each request - if a workflow id for an existing request is passed, this API call will fail.
        RedirectUrl:
          type: string
          description: The URL to redirect to after the delegation request is processed. This URL is used by the IAM console to show a link to the customer to re-load the partner workflow.
        NotificationChannel:
          type: string
          description: The notification channel for updates about the delegation request. At this time,only SNS topic ARNs are accepted for notification. This topic ARN must have a resource policy granting SNS:Publish permission to the IAM service principal (iam.amazonaws.com). See partner onboarding documentation for more details.
        SessionDuration:
          type: integer
          description: The duration for which the delegated session should remain active, in seconds. The active time window for the session starts when the customer calls the SendDelegationToken API.
        OnlySendByOwner:
          type: boolean
          description: Specifies whether the delegation token should only be sent by the owner. This flag prevents any party other than the owner from calling SendDelegationToken API for this delegation request. This behavior becomes useful when the delegation request owner needs to be present for subsequent partner interactions, but the delegation request was sent to a more privileged user for approval due to the owner lacking sufficient delegation permissions.
      required:
      - Description
      - Permissions
      - RequestorWorkflowId
      - NotificationChannel
      - SessionDuration
    ListDelegationRequestsResponse:
      type: object
      properties:
        DelegationRequests:
          type: array
          items:
            $ref: '#/components/schemas/DelegationRequest'
          description: A list of delegation requests that match the specified criteria.
        Marker:
          type: string
          description: When isTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
        isTruncated:
          type: boolean
          description: A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items.
    CreateDelegationRequestResponse:
      type: object
      properties:
        ConsoleDeepLink:
          type: string
          description: A deep link URL to the Amazon Web Services Management Console for managing the delegation request. For a console based workflow, partners should redirect the customer to this URL. If the customer is not logged in to any Amazon Web Services account, the Amazon Web Services workflow will automatically direct the customer to log in and then display the delegation request approval page.
        DelegationRequestId:
          type: string
          description: The unique identifier for the created delegation request.
    DelegationRequest:
      type: object
      properties:
        DelegationRequestId:
          type: string
          description: The unique identifier for the delegation request.
        OwnerAccountId:
          type: string
          description: Amazon Web Services account ID of the owner of the delegation request.
        Description:
          type: string
          description: Description of the delegation request. This is a message that is provided by the Amazon Web Services partner that filed the delegation request.
        RequestMessage:
          type: string
          description: A custom message that is added to the delegation request by the partner. This element is different from the Description element such that this is a request specific message injected by the partner. The Description is typically a generic explanation of what the delegation request is targeted to do.
        Permissions:
          $ref: '#/components/schemas/DelegationPermission'
        PermissionPolicy:
          type: string
          description: JSON content of the associated permission policy of this delegation request.
        RolePermissionRestrictionArns:
          type: array
          items:
            type: string
          description: If the PermissionPolicy includes role creation permissions, this element will include the list of permissions boundary policies associated with the role creation. See Permissions boundaries for IAM entities for more details about IAM permission boundaries.
        OwnerId:
          type: string
          description: ARN of the owner of this delegation request.
        ApproverId:
          type: string
        State:
          type: string
          enum:
          - UNASSIGNED
          - ASSIGNED
          - PENDING_APPROVAL
          - FINALIZED
          - ACCEPTED
          - REJECTED
          - EXPIRED
          description: The state of this delegation request. See the Understanding the Request Lifecycle for an explanation of how these states are transitioned.
        ExpirationTime:
          type: string
          format: date-time
          description: The expiry time of this delegation request See the Understanding the Request Lifecycle for details on the life time of a delegation request at each state.
        RequestorId:
          type: string
          description: Identity of the requestor of this delegation request. This will be an Amazon Web Services account ID.
        RequestorName:
          type: string
          description: A friendly name of the requestor.
        CreateDate:
          type: string
          format: date-time
          description: Creation date (timestamp) of this delegation request.
        SessionDuration:
          type: integer
          description: The life-time of the requested session credential.
        RedirectUrl:
          type: string
          description: A URL to be redirected to once the delegation request is approved. Partners provide this URL when creating the delegation request.
        Notes:
          type: string
          description: Notes added to this delegation request, if this request was updated via the UpdateDelegationRequest API.
        RejectionReason:
          type: string
          description: Reasons for rejecting this delegation request, if this request was rejected. See also RejectDelegationRequest API documentation.
        OnlySendByOwner:
          type: boolean
          description: A flag indicating whether the SendDelegationToken must be called by the owner of this delegation request. This is set by the requesting partner.
        UpdatedTime:
          type: string
          format: date-time
          description: Last updated timestamp of the request.
    PolicyParameter:
      type: object
      properties:
        Name:
          type: string
          description: The name of the policy parameter.
        Values:
          type: array
          items:
            type: string
          description: The allowed values for the policy parameter.
        Type:
          type: string
          enum:
          - string
          - stringList
          description: The data type of the policy parameter value.
    NoSuchEntityException:
      type: object
      properties:
        message:
          type: string
    AcceptDelegationRequestRequest:
      type: object
      properties:
        DelegationRequestId:
          type: string
          description: The unique identifier of the delegation request to accept.
      required:
      - DelegationRequestId
    InvalidInputException:
      type: object
      properties:
        message:
          type: string
    GetDelegationRequestResponse:
      type: object
      properties:
        DelegationRequest:
          $ref: '#/components/schemas/DelegationRequest'
        PermissionCheckStatus:
          type: string
          enum:
          - COMPLETE
          - IN_PROGRESS
          - FAILED
          description: 'The status of the permission check for the delegation request. This value indicates the status of the process to check whether the caller has sufficient permissions to cover the requested actions in the delegation request. Since this is an asynchronous process, there are three potential values: IN_PROGRESS : The permission check process has started. COMPLETED : The permission check process has completed. The PermissionCheckResult will include the result. FAILED : The permission check process has failed.'
        PermissionCheckResult:
          type: string
          enum:
          - ALLOWED
          - DENIED
          - UNSURE
          description: 'The result of the permission check, indicating whether the caller has sufficient permissions to cover the requested permissions. This is an approximate result. ALLOWED : The caller has sufficient permissions cover all the requested permissions. DENIED : The caller does not have sufficient permissions to cover all the requested permissions. UNSURE : It is not possible to determine whether the caller has all the permissions needed. This output is most likely for cases when the caller has permissions with conditions.'
    GetDelegationRequestRequest:
      type: object
      properties:
        DelegationRequestId:
          type: string
          description: The unique identifier of the delegation request to retrieve.
        DelegationPermissionCheck:
          type: boolean
          description: Specifies whether to perform a permission check for the delegation request. If set to true, the GetDelegationRequest API call will start a permission check process. This process calculates whether the caller has sufficient permissions to cover the asks from this delegation request. Setting this parameter to true does not guarantee an answer in the response. See the PermissionCheckStatus and the PermissionCheckResult response attributes for further details.
      required:
      - DelegationRequestId
    UpdateDelegationRequestRequest:
      type: object
      properties:
        DelegationRequestId:
          type: string
          description: The unique identifier of the delegation request to update.
        Notes:
          type: string
          description: Additional notes or comments to add to the delegation request.
      required:
      - DelegationRequestId
    ConcurrentModificationException:
      type: object
      properties:
        message:
          type: string
    AssociateDelegationRequestRequest:
      type: object
      properties:
        DelegationRequestId:
          type: string
          description: The unique identifier of the delegation request to associate.
      required:
      - DelegationRequestId
    DelegationPermission:
      type: object
      properties:
        PolicyTemplateArn:
          type: string
          description: This ARN maps to a pre-registered policy content for this partner. See the partner onboarding documentation to understand how to create a delegation template.
        Parameters:
          type: array
          items:
            $ref: '#/components/schemas/PolicyParameter'
          description: A list of policy parameters that define the scope and constraints of the delegated permissions.
    RejectDelegationRequestRequest:
      type: object
      properties:
        DelegationRequestId:
          type: string
          description: The unique identifier of the delegation request to reject.
        Notes:
          type: string
          description: Optional notes explaining the reason for rejecting the delegation request.
      required:
      - DelegationRequestId
    ServiceFailureException:
      type: object
      properties:
        message:
          type: string
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: iam
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/iam/service/2010-05-08/iam-2010-05-08.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)