Amazon IAM Iam Saml Provider API

openapi: 3.2.0
info:
  title: AWS Identity and Access Management Saml Provider API
  version: '2010-05-08'
  description: Generated from AWS's published Smithy model for AWS Identity and Access Management. 7 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://iam.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Saml Provider
paths:
  /?Action=CreateSAMLProvider:
    post:
      operationId: CreateSAMLProvider
      summary: Create SAMLProvider
      description: Creates an IAM resource that describes an identity provider (IdP) that supports SAML 2.0. The SAML provider resource that you create with this operation can be used as a principal in an IAM role's trust policy. Such a policy can enable federated users who sign in using the SAML IdP to assume the role. You can create an IAM role that supports Web-based single sign-on (SSO) to the Amazon Web Services Management Console or one that supports API access to Amazon Web Services. When you create the SAML provider resource, you upload a SAML metadata document that you get from your IdP. That document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that the IdP sends. You must generate the metadata document using the identity management software that is used as your organization's IdP. This operation requires Signature Version 4. For more information, see Enabling SAML 2.0 federated users to access the Amazon Web Services Management Console and About SAML 2.0-based federation in the IAM User Guide.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/CreateSAMLProviderResponse'
        '409':
          description: ConcurrentModificationException; EntityAlreadyExistsException; LimitExceededException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ConcurrentModificationException'
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: CreateSAMLProvider
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/CreateSAMLProviderRequest'
      tags:
      - Saml Provider
  /?Action=DeleteSAMLProvider:
    post:
      operationId: DeleteSAMLProvider
      summary: Delete SAMLProvider
      description: Deletes a SAML provider resource in IAM. Deleting the provider resource from IAM does not update any roles that reference the SAML provider resource's ARN as a principal in their trust policies. Any attempt to assume a role that references a non-existent provider resource ARN fails. This operation requires Signature Version 4.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                type: string
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '409':
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/LimitExceededException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: DeleteSAMLProvider
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/DeleteSAMLProviderRequest'
      tags:
      - Saml Provider
  /?Action=GetSAMLProvider:
    post:
      operationId: GetSAMLProvider
      summary: Get SAMLProvider
      description: Returns the SAML provider metadocument that was uploaded when the IAM SAML provider resource object was created or updated. This operation requires Signature Version 4.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/GetSAMLProviderResponse'
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: GetSAMLProvider
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/GetSAMLProviderRequest'
      tags:
      - Saml Provider
  /?Action=ListSAMLProviders:
    post:
      operationId: ListSAMLProviders
      summary: List SAMLProviders
      description: Lists the SAML provider resource objects defined in IAM in the account. IAM resource-listing operations return a subset of the available attributes for the resource. For example, this operation does not return tags, even though they are an attribute of the returned object. To view all of the information for a SAML provider, see GetSAMLProvider. This operation requires Signature Version 4.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ListSAMLProvidersResponse'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: ListSAMLProviders
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/ListSAMLProvidersRequest'
      tags:
      - Saml Provider
  /?Action=TagSAMLProvider:
    post:
      operationId: TagSAMLProvider
      summary: Tag SAMLProvider
      description: 'Adds one or more tags to a Security Assertion Markup Language (SAML) identity provider. For more information about these providers, see About SAML 2.0-based federation . If a tag with the same key name already exists, then that tag is overwritten with the new value. A tag consists of a key name and an associated value. By assigning tags to your resources, you can do the following: Administrative grouping and discovery - Attach tags to resources to aid in organization and search. For example, you could search for all resources with the key name Project and the value MyImportantProject. Or search for all resources with the key name Cost Center and the value 41200. Access control - Include tags in IAM user-based and resource-based policies. You can use tags to restrict access to only a SAML identity provider that has a specified tag attached. For examples of policies that show how to use tags to control access, see Control access using IAM tags in the IAM User Guide. If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created. For more information about tagging, see Tagging IAM resources in the IA'
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                type: string
        '409':
          description: ConcurrentModificationException; LimitExceededException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ConcurrentModificationException'
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: TagSAMLProvider
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/TagSAMLProviderRequest'
      tags:
      - Saml Provider
  /?Action=UntagSAMLProvider:
    post:
      operationId: UntagSAMLProvider
      summary: Untag SAMLProvider
      description: Removes the specified tags from the specified Security Assertion Markup Language (SAML) identity provider in IAM. For more information about these providers, see About web identity federation. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                type: string
        '409':
          description: ConcurrentModificationException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ConcurrentModificationException'
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: UntagSAMLProvider
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/UntagSAMLProviderRequest'
      tags:
      - Saml Provider
  /?Action=UpdateSAMLProvider:
    post:
      operationId: UpdateSAMLProvider
      summary: Update SAMLProvider
      description: Updates the metadata document, SAML encryption settings, and private keys for an existing SAML provider. To rotate private keys, add your new private key and then remove the old key in a separate request.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/UpdateSAMLProviderResponse'
        '409':
          description: ConcurrentModificationException; LimitExceededException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ConcurrentModificationException'
        '400':
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '404':
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/NoSuchEntityException'
        '500':
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ServiceFailureException'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: UpdateSAMLProvider
                  Version:
                    type: string
                    const: '2010-05-08'
              - $ref: '#/components/schemas/UpdateSAMLProviderRequest'
      tags:
      - Saml Provider
components:
  schemas:
    GetSAMLProviderRequest:
      type: object
      properties:
        SAMLProviderArn:
          type: string
          description: The Amazon Resource Name (ARN) of the SAML provider resource object in IAM to get information about. For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
      required:
      - SAMLProviderArn
    GetSAMLProviderResponse:
      type: object
      properties:
        SAMLProviderUUID:
          type: string
          description: The unique identifier assigned to the SAML provider.
        SAMLMetadataDocument:
          type: string
          description: The XML metadata document that includes information about an identity provider.
        CreateDate:
          type: string
          format: date-time
          description: The date and time when the SAML provider was created.
        ValidUntil:
          type: string
          format: date-time
          description: The expiration date and time for the SAML provider.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: A list of tags that are attached to the specified IAM SAML provider. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
        AssertionEncryptionMode:
          type: string
          enum:
          - Required
          - Allowed
          description: Specifies the encryption setting for the SAML provider.
        PrivateKeyList:
          type: array
          items:
            $ref: '#/components/schemas/SAMLPrivateKey'
          description: The private key metadata for the SAML provider.
    UpdateSAMLProviderRequest:
      type: object
      properties:
        SAMLMetadataDocument:
          type: string
          description: An XML document generated by an identity provider (IdP) that supports SAML 2.0. The document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that are received from the IdP. You must generate the metadata document using the identity management software that is used as your IdP.
        SAMLProviderArn:
          type: string
          description: The Amazon Resource Name (ARN) of the SAML provider to update. For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
        AssertionEncryptionMode:
          type: string
          enum:
          - Required
          - Allowed
          description: Specifies the encryption setting for the SAML provider.
        AddPrivateKey:
          type: string
          description: Specifies the new private key from your external identity provider. The private key must be a .pem file that uses AES-GCM or AES-CBC encryption algorithm to decrypt SAML assertions.
        RemovePrivateKey:
          type: string
          description: The Key ID of the private key to remove.
      required:
      - SAMLProviderArn
    SAMLProviderListEntry:
      type: object
      properties:
        Arn:
          type: string
          description: The Amazon Resource Name (ARN) of the SAML provider.
        ValidUntil:
          type: string
          format: date-time
          description: The expiration date and time for the SAML provider.
        CreateDate:
          type: string
          format: date-time
          description: The date and time when the SAML provider was created.
    InvalidInputException:
      type: object
      properties:
        message:
          type: string
    CreateSAMLProviderResponse:
      type: object
      properties:
        SAMLProviderArn:
          type: string
          description: The Amazon Resource Name (ARN) of the new SAML provider resource in IAM.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: A list of tags that are attached to the new IAM SAML provider. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
    ListSAMLProvidersResponse:
      type: object
      properties:
        SAMLProviderList:
          type: array
          items:
            $ref: '#/components/schemas/SAMLProviderListEntry'
          description: The list of SAML provider resource objects defined in IAM for this Amazon Web Services account.
    ServiceFailureException:
      type: object
      properties:
        message:
          type: string
    TagSAMLProviderRequest:
      type: object
      properties:
        SAMLProviderArn:
          type: string
          description: 'The ARN of the SAML identity provider in IAM to which you want to add tags. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-'
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: The list of tags that you want to attach to the SAML identity provider in IAM. Each tag consists of a key name and an associated value.
      required:
      - SAMLProviderArn
      - Tags
    NoSuchEntityException:
      type: object
      properties:
        message:
          type: string
    UpdateSAMLProviderResponse:
      type: object
      properties:
        SAMLProviderArn:
          type: string
          description: The Amazon Resource Name (ARN) of the SAML provider that was updated.
    ListSAMLProvidersRequest:
      type: object
      properties: {}
    CreateSAMLProviderRequest:
      type: object
      properties:
        SAMLMetadataDocument:
          type: string
          description: An XML document generated by an identity provider (IdP) that supports SAML 2.0. The document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that are received from the IdP. You must generate the metadata document using the identity management software that is used as your organization's IdP. For more information, see About SAML 2.0-based federation in the IAM User Guide
        Name:
          type: string
          description: 'The name of the provider to create. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-'
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: A list of tags that you want to attach to the new IAM SAML provider. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide. If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.
        AssertionEncryptionMode:
          type: string
          enum:
          - Required
          - Allowed
          description: Specifies the encryption setting for the SAML provider.
        AddPrivateKey:
          type: string
          description: The private key generated from your external identity provider. The private key must be a .pem file that uses AES-GCM or AES-CBC encryption algorithm to decrypt SAML assertions.
      required:
      - SAMLMetadataDocument
      - Name
    Tag:
      type: object
      properties:
        Key:
          type: string
          description: The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        Value:
          type: string
          description: The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
      required:
      - Key
      - Value
    LimitExceededException:
      type: object
      properties:
        message:
          type: string
    DeleteSAMLProviderRequest:
      type: object
      properties:
        SAMLProviderArn:
          type: string
          description: The Amazon Resource Name (ARN) of the SAML provider to delete.
      required:
      - SAMLProviderArn
    ConcurrentModificationException:
      type: object
      properties:
        message:
          type: string
    UntagSAMLProviderRequest:
      type: object
      properties:
        SAMLProviderArn:
          type: string
          description: 'The ARN of the SAML identity provider in IAM from which you want to remove tags. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-'
        TagKeys:
          type: array
          items:
            type: string
          description: A list of key names as a simple array of strings. The tags with matching keys are removed from the specified SAML identity provider.
      required:
      - SAMLProviderArn
      - TagKeys
    SAMLPrivateKey:
      type: object
      properties:
        KeyId:
          type: string
          description: The unique identifier for the SAML private key.
        Timestamp:
          type: string
          format: date-time
          description: The date and time, in ISO 8601 date-time format, when the private key was uploaded.
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: iam
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/iam/service/2010-05-08/iam-2010-05-08.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)