Amazon IAM Iam Open Id Connect Provider API

openapi: 3.2.0
info:
  title: AWS Identity and Access Management Open Id Connect Provider…
  version: '2010-05-08'
  description: Generated from AWS's published Smithy model for AWS Identity and Access Management. 6 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://iam.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Open Id Connect Provider
paths:
  /?Action=CreateOpenIDConnectProvider:
    post:
      operationId: CreateOpenIDConnectProvider
      summary: Create Open IDConnect Provider
      description: 'Creates an IAM entity to describe an identity provider (IdP) that supports OpenID Connect (OIDC). The OIDC provider that you create with this operation can be used as a principal in a role''s trust policy. Such a policy establishes a trust relationship between Amazon Web Services and the OIDC provider. If you are using an OIDC identity provider from Google, Facebook, or Amazon Cognito, you don''t need to create a separate IAM identity provider. These OIDC identity providers are already built-in to Amazon Web Services and are available for your use. Instead, you can move directly to creating new roles using your identity provider. To learn more, see Creating a role for web identity or OpenID connect federation in the IAM User Guide. When you create the IAM OIDC provider, you specify the following: The URL of the OIDC identity provider (IdP) to trust A list of client IDs (also known as audiences) that identify the application or applications allowed to authenticate using the OIDC provider A list of tags that are attached to the specified IAM OIDC provider A list of thumbprints of one or more server certificates that the IdP uses You get all of this information from the OIDC IdP you wan'
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/CreateOpenIDConnectProviderResponse'
              example:
                OpenIDConnectProviderArn: arn:aws:iam::123456789012:oidc-provider/server.example.com
        '409':
          description: ConcurrentModificationException; EntityAlreadyExistsException; LimitExceededException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ConcurrentModificationException'
        '400':
          description: InvalidInputException; OpenIdIdpCommunicationErrorException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: CreateOpenIDConnectProvider
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/CreateOpenIDConnectProviderRequest'
            example:
              ClientIDList:
              - my-application-id
              ThumbprintList:
              - 3768084dfb3d2b68b7897bf5f565da8efEXAMPLE
              Url: https://server.example.com
      tags:
      - Open Id Connect Provider
  /?Action=DeleteOpenIDConnectProvider:
    post:
      operationId: DeleteOpenIDConnectProvider
      summary: Delete Open IDConnect Provider
      description: Deletes an OpenID Connect identity provider (IdP) resource object in IAM. Deleting an IAM OIDC provider resource does not update any roles that reference the provider as a principal in their trust policies. Any attempt to assume a role that references a deleted provider fails. This operation is idempotent; it does not fail or return an error if you call the operation for a provider that does not exist.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                type: string
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: DeleteOpenIDConnectProvider
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/DeleteOpenIDConnectProviderRequest'
      tags:
      - Open Id Connect Provider
  /?Action=GetOpenIDConnectProvider:
    post:
      operationId: GetOpenIDConnectProvider
      summary: Get Open IDConnect Provider
      description: Returns information about the specified OpenID Connect (OIDC) provider resource object in IAM.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/GetOpenIDConnectProviderResponse'
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: GetOpenIDConnectProvider
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/GetOpenIDConnectProviderRequest'
      tags:
      - Open Id Connect Provider
  /?Action=ListOpenIDConnectProviders:
    post:
      operationId: ListOpenIDConnectProviders
      summary: List Open IDConnect Providers
      description: Lists information about the IAM OpenID Connect (OIDC) provider resource objects defined in the Amazon Web Services account. IAM resource-listing operations return a subset of the available attributes for the resource. For example, this operation does not return tags, even though they are an attribute of the returned object. To view all of the information for an OIDC provider, see GetOpenIDConnectProvider.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ListOpenIDConnectProvidersResponse'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: ListOpenIDConnectProviders
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/ListOpenIDConnectProvidersRequest'
      tags:
      - Open Id Connect Provider
  /?Action=TagOpenIDConnectProvider:
    post:
      operationId: TagOpenIDConnectProvider
      summary: Tag Open IDConnect Provider
      description: 'Adds one or more tags to an OpenID Connect (OIDC)-compatible identity provider. For more information about these providers, see About web identity federation. If a tag with the same key name already exists, then that tag is overwritten with the new value. A tag consists of a key name and an associated value. By assigning tags to your resources, you can do the following: Administrative grouping and discovery - Attach tags to resources to aid in organization and search. For example, you could search for all resources with the key name Project and the value MyImportantProject. Or search for all resources with the key name Cost Center and the value 41200. Access control - Include tags in IAM identity-based and resource-based policies. You can use tags to restrict access to only an OIDC provider that has a specified tag attached. For examples of policies that show how to use tags to control access, see Control access using IAM tags in the IAM User Guide. If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created. For more information about tagging, see Tagging IAM resources in the IAM User Guide. A'
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                type: string
        '409':
          description: ConcurrentModificationException; LimitExceededException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ConcurrentModificationException'
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: TagOpenIDConnectProvider
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/TagOpenIDConnectProviderRequest'
      tags:
      - Open Id Connect Provider
  /?Action=UntagOpenIDConnectProvider:
    post:
      operationId: UntagOpenIDConnectProvider
      summary: Untag Open IDConnect Provider
      description: Removes the specified tags from the specified OpenID Connect (OIDC)-compatible identity provider in IAM. For more information about OIDC providers, see About web identity federation. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                type: string
        '409':
          description: ConcurrentModificationException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ConcurrentModificationException'
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: UntagOpenIDConnectProvider
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/UntagOpenIDConnectProviderRequest'
      tags:
      - Open Id Connect Provider
components:
  schemas:
    TagOpenIDConnectProviderRequest:
      type: object
      properties:
        OpenIDConnectProviderArn:
          type: string
          description: 'The ARN of the OIDC identity provider in IAM to which you want to add tags. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-'
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: The list of tags that you want to attach to the OIDC identity provider in IAM. Each tag consists of a key name and an associated value.
      required:
      - OpenIDConnectProviderArn
      - Tags
    NoSuchEntityException:
      type: object
      properties:
        message:
          type: string
    CreateOpenIDConnectProviderResponse:
      type: object
      properties:
        OpenIDConnectProviderArn:
          type: string
          description: The Amazon Resource Name (ARN) of the new IAM OpenID Connect provider that is created. For more information, see OpenIDConnectProviderListEntry.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: A list of tags that are attached to the new IAM OIDC provider. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
    UntagOpenIDConnectProviderRequest:
      type: object
      properties:
        OpenIDConnectProviderArn:
          type: string
          description: 'The ARN of the OIDC provider in IAM from which you want to remove tags. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-'
        TagKeys:
          type: array
          items:
            type: string
          description: A list of key names as a simple array of strings. The tags with matching keys are removed from the specified OIDC provider.
      required:
      - OpenIDConnectProviderArn
      - TagKeys
    ListOpenIDConnectProvidersRequest:
      type: object
      properties: {}
    OpenIDConnectProviderListEntry:
      type: object
      properties:
        Arn:
          type: string
    CreateOpenIDConnectProviderRequest:
      type: object
      properties:
        Url:
          type: string
          description: 'The URL of the identity provider. The URL must begin with https:// and should correspond to the iss claim in the provider''s OpenID Connect ID tokens. Per the OIDC standard, path components are allowed but query parameters are not. Typically the URL consists of only a hostname, like https://server.example.org or https://example.com. The URL should not contain a port number. You cannot register the same provider multiple times in a single Amazon Web Services account. If you try to submit a URL that has already been used for an OpenID Connect provider in the Amazon Web Services account, you will '
        ClientIDList:
          type: array
          items:
            type: string
          description: 'Provides a list of client IDs, also known as audiences. When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. This is the value that''s sent as the client_id parameter on OAuth requests. You can register multiple client IDs with the same provider. For example, you might have multiple applications that use the same OIDC provider. You cannot register more than 100 client IDs with a single IAM OIDC provider. There is no defined format for a client ID. The CreateOpenIDConnectProviderRequest operation accepts client IDs up to 255 '
        ThumbprintList:
          type: array
          items:
            type: string
          description: A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificates. Typically this list includes only one entry. However, IAM lets you have up to five thumbprints for an OIDC provider. This lets you maintain multiple thumbprints if the identity provider is rotating certificates. This parameter is optional. If it is not included, IAM will retrieve and use the top intermediate certificate authority (CA) thumbprint of the OpenID Connect identity provider server certificate. The server certificate thumbprint is the hex-encoded SHA-1 hash value of the X.5
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: A list of tags that you want to attach to the new IAM OpenID Connect (OIDC) provider. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide. If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.
      required:
      - Url
    GetOpenIDConnectProviderRequest:
      type: object
      properties:
        OpenIDConnectProviderArn:
          type: string
          description: The Amazon Resource Name (ARN) of the OIDC provider resource object in IAM to get information for. You can get a list of OIDC provider resource ARNs by using the ListOpenIDConnectProviders operation. For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
      required:
      - OpenIDConnectProviderArn
    Tag:
      type: object
      properties:
        Key:
          type: string
          description: The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        Value:
          type: string
          description: The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
      required:
      - Key
      - Value
    ListOpenIDConnectProvidersResponse:
      type: object
      properties:
        OpenIDConnectProviderList:
          type: array
          items:
            $ref: '#/components/schemas/OpenIDConnectProviderListEntry'
          description: The list of IAM OIDC provider resource objects defined in the Amazon Web Services account.
    DeleteOpenIDConnectProviderRequest:
      type: object
      properties:
        OpenIDConnectProviderArn:
          type: string
          description: The Amazon Resource Name (ARN) of the IAM OpenID Connect provider resource object to delete. You can get a list of OpenID Connect provider resource ARNs by using the ListOpenIDConnectProviders operation.
      required:
      - OpenIDConnectProviderArn
    InvalidInputException:
      type: object
      properties:
        message:
          type: string
    ConcurrentModificationException:
      type: object
      properties:
        message:
          type: string
    ServiceFailureException:
      type: object
      properties:
        message:
          type: string
    GetOpenIDConnectProviderResponse:
      type: object
      properties:
        Url:
          type: string
          description: The URL that the IAM OIDC provider resource object is associated with. For more information, see CreateOpenIDConnectProvider.
        ClientIDList:
          type: array
          items:
            type: string
          description: A list of client IDs (also known as audiences) that are associated with the specified IAM OIDC provider resource object. For more information, see CreateOpenIDConnectProvider.
        ThumbprintList:
          type: array
          items:
            type: string
          description: A list of certificate thumbprints that are associated with the specified IAM OIDC provider resource object. For more information, see CreateOpenIDConnectProvider.
        CreateDate:
          type: string
          format: date-time
          description: The date and time when the IAM OIDC provider resource object was created in the Amazon Web Services account.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: A list of tags that are attached to the specified IAM OIDC provider. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: iam
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/iam/service/2010-05-08/iam-2010-05-08.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)