The Principal Policies API from Amazon IoT Core — 1 operation(s) for principal policies.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/amazon-iot-core:amazon-iot-core-principal-policies-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Amazon Iot Core Principal Policies API
x-refined-note:
- x-apiClientRegistration differs across the merged source definitions and was not carried
- x-apisguru-categories differs across the merged source definitions and was not carried
- x-aws-signingName differs across the merged source definitions and was not carried
- x-logo differs across the merged source definitions and was not carried
- x-origin differs across the merged source definitions and was not carried
- x-preferred differs across the merged source definitions and was not carried
- x-providerName differs across the merged source definitions and was not carried
- x-release differs across the merged source definitions and was not carried
- x-serviceName differs across the merged source definitions and was not carried
version: '1.0'
description: 'Operations tagged Principal Policies across 2 of this provider''s published API definitions: amazon-iot-core-openapi-original.yml, amazon-iot-core-principal-policies-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: http://iot.{region}.amazonaws.com
variables:
region:
description: The AWS region
enum:
- us-east-1
- us-east-2
- us-west-1
- us-west-2
- us-gov-west-1
- us-gov-east-1
- ca-central-1
- eu-north-1
- eu-west-1
- eu-west-2
- eu-west-3
- eu-central-1
- eu-south-1
- af-south-1
- ap-northeast-1
- ap-northeast-2
- ap-northeast-3
- ap-southeast-1
- ap-southeast-2
- ap-east-1
- ap-south-1
- sa-east-1
- me-south-1
default: us-east-1
description: The AWS IoT multi-region endpoint
- url: https://iot.{region}.amazonaws.com
variables:
region:
description: The AWS region
enum:
- us-east-1
- us-east-2
- us-west-1
- us-west-2
- us-gov-west-1
- us-gov-east-1
- ca-central-1
- eu-north-1
- eu-west-1
- eu-west-2
- eu-west-3
- eu-central-1
- eu-south-1
- af-south-1
- ap-northeast-1
- ap-northeast-2
- ap-northeast-3
- ap-southeast-1
- ap-southeast-2
- ap-east-1
- ap-south-1
- sa-east-1
- me-south-1
default: us-east-1
description: The AWS IoT multi-region endpoint
- url: http://iot.{region}.amazonaws.com.cn
variables:
region:
description: The AWS region
enum:
- cn-north-1
- cn-northwest-1
default: cn-north-1
description: The AWS IoT endpoint for China (Beijing) and China (Ningxia)
- url: https://iot.{region}.amazonaws.com.cn
variables:
region:
description: The AWS region
enum:
- cn-north-1
- cn-northwest-1
default: cn-north-1
description: The AWS IoT endpoint for China (Beijing) and China (Ningxia)
tags:
- name: Principal Policies
paths:
/principal-policies/{policyName}#x-amzn-iot-principal:
parameters:
- $ref: '#/components/parameters/X-Amz-Content-Sha256'
- $ref: '#/components/parameters/X-Amz-Date'
- $ref: '#/components/parameters/X-Amz-Algorithm'
- $ref: '#/components/parameters/X-Amz-Credential'
- $ref: '#/components/parameters/X-Amz-Security-Token'
- $ref: '#/components/parameters/X-Amz-Signature'
- $ref: '#/components/parameters/X-Amz-SignedHeaders'
put:
deprecated: true
operationId: AttachPrincipalPolicy
description: 'Attaches the specified policy to the specified principal (certificate or other credential).
Note: This action is deprecated and works as expected for backward compatibility, but we won''t add enhancements. Use AttachPolicy instead.
Requires permission to access the AttachPrincipalPolicy action.'
responses:
'200':
description: Success
'480':
description: ResourceNotFoundException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceNotFoundException'
'481':
description: InvalidRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidRequestException'
'482':
description: ThrottlingException
content:
application/json:
schema:
$ref: '#/components/schemas/ThrottlingException'
'483':
description: UnauthorizedException
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedException'
'484':
description: ServiceUnavailableException
content:
application/json:
schema:
$ref: '#/components/schemas/ServiceUnavailableException'
'485':
description: InternalFailureException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalFailureException'
'486':
description: LimitExceededException
content:
application/json:
schema:
$ref: '#/components/schemas/LimitExceededException'
parameters:
- name: policyName
in: path
required: true
description: The policy name.
schema:
type: string
pattern: '[\w+=,.@-]+'
minLength: 1
maxLength: 128
- name: x-amzn-iot-principal
in: header
required: true
description: The principal, which can be a certificate ARN (as returned from the CreateCertificate operation) or an Amazon Cognito ID.
schema:
type: string
summary: Amazon IoT Core Attach Principal Policy
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
tags:
- Principal Policies
security:
- hmac: []
delete:
deprecated: true
operationId: DetachPrincipalPolicy
description: 'Removes the specified policy from the specified certificate.
Note: This action is deprecated and works as expected for backward compatibility, but we won''t add enhancements. Use DetachPolicy instead.
Requires permission to access the DetachPrincipalPolicy action.'
responses:
'200':
description: Success
'480':
description: ResourceNotFoundException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceNotFoundException'
'481':
description: InvalidRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidRequestException'
'482':
description: ThrottlingException
content:
application/json:
schema:
$ref: '#/components/schemas/ThrottlingException'
'483':
description: UnauthorizedException
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedException'
'484':
description: ServiceUnavailableException
content:
application/json:
schema:
$ref: '#/components/schemas/ServiceUnavailableException'
'485':
description: InternalFailureException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalFailureException'
parameters:
- name: policyName
in: path
required: true
description: The name of the policy to detach.
schema:
type: string
pattern: '[\w+=,.@-]+'
minLength: 1
maxLength: 128
- name: x-amzn-iot-principal
in: header
required: true
description: <p>The principal.</p> <p>Valid principals are CertificateArn (arn:aws:iot:<i>region</i>:<i>accountId</i>:cert/<i>certificateId</i>), thingGroupArn (arn:aws:iot:<i>region</i>:<i>accountId</i>:thinggroup/<i>groupName</i>) and CognitoId (<i>region</i>:<i>id</i>).</p>
schema:
type: string
summary: Amazon IoT Core Detach Principal Policy
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
tags:
- Principal Policies
security:
- hmac: []
servers:
- url: http://iot.{region}.amazonaws.com
variables:
region:
description: The AWS region
enum:
- us-east-1
- us-east-2
- us-west-1
- us-west-2
- us-gov-west-1
- us-gov-east-1
- ca-central-1
- eu-north-1
- eu-west-1
- eu-west-2
- eu-west-3
- eu-central-1
- eu-south-1
- af-south-1
- ap-northeast-1
- ap-northeast-2
- ap-northeast-3
- ap-southeast-1
- ap-southeast-2
- ap-east-1
- ap-south-1
- sa-east-1
- me-south-1
default: us-east-1
description: The AWS IoT multi-region endpoint
- url: https://iot.{region}.amazonaws.com
variables:
region:
description: The AWS region
enum:
- us-east-1
- us-east-2
- us-west-1
- us-west-2
- us-gov-west-1
- us-gov-east-1
- ca-central-1
- eu-north-1
- eu-west-1
- eu-west-2
- eu-west-3
- eu-central-1
- eu-south-1
- af-south-1
- ap-northeast-1
- ap-northeast-2
- ap-northeast-3
- ap-southeast-1
- ap-southeast-2
- ap-east-1
- ap-south-1
- sa-east-1
- me-south-1
default: us-east-1
description: The AWS IoT multi-region endpoint
- url: http://iot.{region}.amazonaws.com.cn
variables:
region:
description: The AWS region
enum:
- cn-north-1
- cn-northwest-1
default: cn-north-1
description: The AWS IoT endpoint for China (Beijing) and China (Ningxia)
- url: https://iot.{region}.amazonaws.com.cn
variables:
region:
description: The AWS region
enum:
- cn-north-1
- cn-northwest-1
default: cn-north-1
description: The AWS IoT endpoint for China (Beijing) and China (Ningxia)
/principal-policies#x-amzn-iot-principal:
parameters:
- $ref: '#/components/parameters/X-Amz-Content-Sha256'
- $ref: '#/components/parameters/X-Amz-Date'
- $ref: '#/components/parameters/X-Amz-Algorithm'
- $ref: '#/components/parameters/X-Amz-Credential'
- $ref: '#/components/parameters/X-Amz-Security-Token'
- $ref: '#/components/parameters/X-Amz-Signature'
- $ref: '#/components/parameters/X-Amz-SignedHeaders'
get:
deprecated: true
operationId: ListPrincipalPolicies
description: 'Lists the policies attached to the specified principal. If you use an Cognito identity, the ID must be in AmazonCognito Identity format.
Note: This action is deprecated and works as expected for backward compatibility, but we won''t add enhancements. Use ListAttachedPolicies instead.
Requires permission to access the ListPrincipalPolicies action.'
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/ListPrincipalPoliciesResponse'
'480':
description: ResourceNotFoundException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceNotFoundException'
'481':
description: InvalidRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidRequestException'
'482':
description: ThrottlingException
content:
application/json:
schema:
$ref: '#/components/schemas/ThrottlingException'
'483':
description: UnauthorizedException
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedException'
'484':
description: ServiceUnavailableException
content:
application/json:
schema:
$ref: '#/components/schemas/ServiceUnavailableException'
'485':
description: InternalFailureException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalFailureException'
parameters:
- name: x-amzn-iot-principal
in: header
required: true
description: The principal. Valid principals are CertificateArn (arn:aws:iot:<i>region</i>:<i>accountId</i>:cert/<i>certificateId</i>), thingGroupArn (arn:aws:iot:<i>region</i>:<i>accountId</i>:thinggroup/<i>groupName</i>) and CognitoId (<i>region</i>:<i>id</i>).
schema:
type: string
- name: marker
in: query
required: false
description: The marker for the next set of results.
schema:
type: string
pattern: '[A-Za-z0-9+/]+={0,2}'
maxLength: 1024
- name: pageSize
in: query
required: false
description: The result page size.
schema:
type: integer
minimum: 1
maximum: 250
- name: isAscendingOrder
in: query
required: false
description: Specifies the order for results. If true, results are returned in ascending creation order.
schema:
type: boolean
summary: Amazon IoT Core List Principal Policies
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
tags:
- Principal Policies
security:
- hmac: []
servers:
- url: http://iot.{region}.amazonaws.com
variables:
region:
description: The AWS region
enum:
- us-east-1
- us-east-2
- us-west-1
- us-west-2
- us-gov-west-1
- us-gov-east-1
- ca-central-1
- eu-north-1
- eu-west-1
- eu-west-2
- eu-west-3
- eu-central-1
- eu-south-1
- af-south-1
- ap-northeast-1
- ap-northeast-2
- ap-northeast-3
- ap-southeast-1
- ap-southeast-2
- ap-east-1
- ap-south-1
- sa-east-1
- me-south-1
default: us-east-1
description: The AWS IoT multi-region endpoint
- url: https://iot.{region}.amazonaws.com
variables:
region:
description: The AWS region
enum:
- us-east-1
- us-east-2
- us-west-1
- us-west-2
- us-gov-west-1
- us-gov-east-1
- ca-central-1
- eu-north-1
- eu-west-1
- eu-west-2
- eu-west-3
- eu-central-1
- eu-south-1
- af-south-1
- ap-northeast-1
- ap-northeast-2
- ap-northeast-3
- ap-southeast-1
- ap-southeast-2
- ap-east-1
- ap-south-1
- sa-east-1
- me-south-1
default: us-east-1
description: The AWS IoT multi-region endpoint
- url: http://iot.{region}.amazonaws.com.cn
variables:
region:
description: The AWS region
enum:
- cn-north-1
- cn-northwest-1
default: cn-north-1
description: The AWS IoT endpoint for China (Beijing) and China (Ningxia)
- url: https://iot.{region}.amazonaws.com.cn
variables:
region:
description: The AWS region
enum:
- cn-north-1
- cn-northwest-1
default: cn-north-1
description: The AWS IoT endpoint for China (Beijing) and China (Ningxia)
/principal-policies/{policyName}:
put:
operationId: putPrincipalPoliciesByPolicyName
summary: Attach Principal Policy
description: 'Attaches the specified policy to the specified principal (certificate or other credential). Note: This action is deprecated and works as expected for backward compatibility, but we won''t add enhancements. Use AttachPolicy instead. Requires permission to access the AttachPrincipalPolicy action.'
responses:
'200':
description: Success
content:
application/json:
schema:
type: string
'500':
description: InternalFailureException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalFailureException_2'
'400':
description: InvalidRequestException; ThrottlingException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidRequestException_2'
'410':
description: LimitExceededException
content:
application/json:
schema:
$ref: '#/components/schemas/LimitExceededException_2'
'404':
description: ResourceNotFoundException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceNotFoundException_2'
'503':
description: ServiceUnavailableException
content:
application/json:
schema:
$ref: '#/components/schemas/ServiceUnavailableException_2'
'401':
description: UnauthorizedException
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedException_2'
deprecated: true
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/AttachPrincipalPolicyRequest'
tags:
- Principal Policies
security:
- sigv4: []
x-operation-id-source: normalized
x-operation-id-original: AttachPrincipalPolicy
delete:
operationId: deletePrincipalPoliciesByPolicyName
summary: Detach Principal Policy
description: 'Removes the specified policy from the specified certificate. Note: This action is deprecated and works as expected for backward compatibility, but we won''t add enhancements. Use DetachPolicy instead. Requires permission to access the DetachPrincipalPolicy action.'
responses:
'200':
description: Success
content:
application/json:
schema:
type: string
'500':
description: InternalFailureException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalFailureException_2'
'400':
description: InvalidRequestException; ThrottlingException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidRequestException_2'
'404':
description: ResourceNotFoundException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceNotFoundException_2'
'503':
description: ServiceUnavailableException
content:
application/json:
schema:
$ref: '#/components/schemas/ServiceUnavailableException_2'
'401':
description: UnauthorizedException
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedException_2'
deprecated: true
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/DetachPrincipalPolicyRequest'
tags:
- Principal Policies
security:
- sigv4: []
x-operation-id-source: normalized
x-operation-id-original: DetachPrincipalPolicy
servers:
- url: https://iot.{region}.amazonaws.com
variables:
region:
default: us-east-1
/principal-policies:
get:
operationId: getPrincipalPolicies
summary: List Principal Policies
description: 'Lists the policies attached to the specified principal. If you use an Cognito identity, the ID must be in AmazonCognito Identity format. Note: This action is deprecated and works as expected for backward compatibility, but we won''t add enhancements. Use ListAttachedPolicies instead. Requires permission to access the ListPrincipalPolicies action.'
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/ListPrincipalPoliciesResponse_2'
'500':
description: InternalFailureException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalFailureException_2'
'400':
description: InvalidRequestException; ThrottlingException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidRequestException_2'
'404':
description: ResourceNotFoundException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceNotFoundException_2'
'503':
description: ServiceUnavailableException
content:
application/json:
schema:
$ref: '#/components/schemas/ServiceUnavailableException_2'
'401':
description: UnauthorizedException
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedException_2'
deprecated: true
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ListPrincipalPoliciesRequest'
tags:
- Principal Policies
security:
- sigv4: []
x-operation-id-source: normalized
x-operation-id-original: ListPrincipalPolicies
servers:
- url: https://iot.{region}.amazonaws.com
variables:
region:
default: us-east-1
components:
parameters:
X-Amz-SignedHeaders:
name: X-Amz-SignedHeaders
in: header
schema:
type: string
required: false
X-Amz-Date:
name: X-Amz-Date
in: header
schema:
type: string
required: false
X-Amz-Signature:
name: X-Amz-Signature
in: header
schema:
type: string
required: false
X-Amz-Security-Token:
name: X-Amz-Security-Token
in: header
schema:
type: string
required: false
X-Amz-Algorithm:
name: X-Amz-Algorithm
in: header
schema:
type: string
required: false
X-Amz-Credential:
name: X-Amz-Credential
in: header
schema:
type: string
required: false
X-Amz-Content-Sha256:
name: X-Amz-Content-Sha256
in: header
schema:
type: string
required: false
schemas:
ListPrincipalPoliciesResponse:
type: object
properties:
policies:
allOf:
- $ref: '#/components/schemas/Policies'
- description: The policies.
nextMarker:
allOf:
- $ref: '#/components/schemas/Marker'
- description: The marker for the next set of results, or null if there are no additional results.
description: The output from the ListPrincipalPolicies operation.
InternalFailureException: {}
Marker:
type: string
pattern: '[A-Za-z0-9+/]+={0,2}'
maxLength: 1024
InvalidRequestException: {}
ServiceUnavailableException: {}
UnauthorizedException: {}
ResourceNotFoundException: {}
ThrottlingException: {}
PolicyArn:
type: string
Policy:
type: object
properties:
policyName:
allOf:
- $ref: '#/components/schemas/PolicyName'
- description: The policy name.
policyArn:
allOf:
- $ref: '#/components/schemas/PolicyArn'
- description: The policy ARN.
description: Describes an IoT policy.
PolicyName:
type: string
pattern: '[\w+=,.@-]+'
minLength: 1
maxLength: 128
LimitExceededException: {}
Policies:
type: array
items:
$ref: '#/components/schemas/Policy'
ListPrincipalPoliciesRequest:
type: object
properties:
principal:
type: string
description: The principal. Valid principals are CertificateArn (arn:aws:iot:region:accountId:cert/certificateId), thingGroupArn (arn:aws:iot:region:accountId:thinggroup/groupName) and CognitoId (region:id).
marker:
type: string
description: The marker for the next set of results.
pageSize:
type: integer
description: The result page size.
ascendingOrder:
type: boolean
description: Specifies the order for results. If true, results are returned in ascending creation order.
required:
- principal
DetachPrincipalPolicyRequest:
type: object
properties:
policyName:
type: string
description: The name of the policy to detach.
principal:
type: string
description: The principal. Valid principals are CertificateArn (arn:aws:iot:region:accountId:cert/certificateId), thingGroupArn (arn:aws:iot:region:accountId:thinggroup/groupName) and CognitoId (region:id).
required:
- policyName
- principal
ServiceUnavailableException_2:
type: object
properties:
message:
type: string
description: The message for the exception.
UnauthorizedException_2:
type: object
properties:
message:
type: string
description: The message for the exception.
ListPrincipalPoliciesResponse_2:
type: object
properties:
policies:
type: array
items:
$ref: '#/components/schemas/Policy_2'
description: The policies.
nextMarker:
type: string
description: The marker for the next set of results, or null if there are no additional results.
InternalFailureException_2:
type: object
properties:
message:
type: string
description: The message for the exception.
AttachPrincipalPolicyRequest:
type: object
properties:
policyName:
type: string
description: The policy name.
principal:
type: string
description: The principal, which can be a certificate ARN (as returned from the CreateCertificate operation) or an Amazon Cognito ID.
required:
- policyName
- principal
Policy_2:
type: object
properties:
policyName:
type: string
description: The policy name.
policyArn:
type: string
description: The policy ARN.
LimitExceededException_2:
type: object
properties:
message:
type: string
description: The message for the exception.
ResourceNotFoundException_2:
type: object
properties:
message:
type: string
description: The message for the exception.
InvalidRequestException_2:
type: object
properties:
message:
type: string
description: The message for the exception.
securitySchemes:
hmac:
type: apiKey
name: Authorization
in: header
description: Amazon Signature authorization v4
x-amazon-apigateway-authtype: awsSigv4
sigv4:
type: apiKey
in: header
name: Authorization
description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
x-aws-sigv4:
signingName: iot
externalDocs:
description: Amazon Web Services documentation
url: https://docs.aws.amazon.com/iot/
x-refined-from:
- amazon-iot-core-openapi-original.yml
- amazon-iot-core-principal-policies-api-openapi.yml
x-hasEquivalentPaths: true