Amazon IoT Device Defender Test Authorization API

openapi: 3.2.0
info:
  version: 2015-05-28
  x-release: v4
  title: AWS IoT Test Authorization API
  description: 'IoT

    IoT provides secure, bi-directional communication between Internet-connected devices (such as sensors, actuators, embedded devices, or smart appliances) and the Amazon Web Services cloud.'
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_twitter.com_awscloud_profile_image.png
    backgroundColor: '#FFFFFF'
  termsOfService: https://aws.amazon.com/service-terms/
  contact:
    name: Mike Ralphson
    email: mike.ralphson@gmail.com
    url: https://github.com/mermade/aws2openapi
    x-twitter: PermittedSoc
  license:
    name: Apache 2.0 License
    url: http://www.apache.org/licenses/
  x-providerName: amazonaws.com
  x-serviceName: iot
  x-aws-signingName: iot
  x-origin:
  - contentType: application/json
    url: https://raw.githubusercontent.com/aws/aws-sdk-js/master/apis/iot-2015-05-28.normal.json
    converter:
      url: https://github.com/mermade/aws2openapi
      version: 1.0.0
    x-apisguru-driver: external
  x-apiClientRegistration:
    url: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct
  x-apisguru-categories:
  - cloud
  x-preferred: true
servers:
- url: http://iot.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The AWS IoT multi-region endpoint
- url: https://iot.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The AWS IoT multi-region endpoint
- url: http://iot.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The AWS IoT endpoint for China (Beijing) and China (Ningxia)
- url: https://iot.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The AWS IoT endpoint for China (Beijing) and China (Ningxia)
security:
- hmac: []
tags:
- name: Test Authorization
paths:
  /test-authorization:
    parameters:
    - $ref: '#/components/parameters/X-Amz-Content-Sha256'
    - $ref: '#/components/parameters/X-Amz-Date'
    - $ref: '#/components/parameters/X-Amz-Algorithm'
    - $ref: '#/components/parameters/X-Amz-Credential'
    - $ref: '#/components/parameters/X-Amz-Security-Token'
    - $ref: '#/components/parameters/X-Amz-Signature'
    - $ref: '#/components/parameters/X-Amz-SignedHeaders'
    post:
      operationId: TestAuthorization
      description: 'Tests if a specified principal is authorized to perform an IoT action on a specified resource. Use this to test and debug the authorization behavior of devices that connect to the IoT device gateway.


        Requires permission to access the TestAuthorization action.'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TestAuthorizationResponse'
        '480':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '481':
          description: InvalidRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidRequestException'
        '482':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '483':
          description: UnauthorizedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedException'
        '484':
          description: ServiceUnavailableException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
        '485':
          description: InternalFailureException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalFailureException'
        '486':
          description: LimitExceededException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LimitExceededException'
      parameters:
      - name: clientId
        in: query
        required: false
        description: The MQTT client ID.
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - authInfos
              properties:
                principal:
                  description: The principal. Valid principals are CertificateArn (arn:aws:iot:<i>region</i>:<i>accountId</i>:cert/<i>certificateId</i>), thingGroupArn (arn:aws:iot:<i>region</i>:<i>accountId</i>:thinggroup/<i>groupName</i>) and CognitoId (<i>region</i>:<i>id</i>).
                  type: string
                cognitoIdentityPoolId:
                  description: The Cognito identity pool ID.
                  type: string
                authInfos:
                  description: A list of authorization info objects. Simulating authorization will create a response for each <code>authInfo</code> object in the list.
                  type: array
                  items:
                    $ref: '#/components/schemas/AuthInfo'
                  minItems: 1
                  maxItems: 10
                policyNamesToAdd:
                  description: When testing custom authorization, the policies specified here are treated as if they are attached to the principal being authorized.
                  type: array
                  items:
                    $ref: '#/components/schemas/PolicyName'
                policyNamesToSkip:
                  description: When testing custom authorization, the policies specified here are treated as if they are not attached to the principal being authorized.
                  type: array
                  items:
                    $ref: '#/components/schemas/PolicyName'
      summary: Amazon IoT Device Defender Test Authorization
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      tags:
      - Test Authorization
components:
  parameters:
    X-Amz-Signature:
      name: X-Amz-Signature
      in: header
      schema:
        type: string
      required: false
    X-Amz-SignedHeaders:
      name: X-Amz-SignedHeaders
      in: header
      schema:
        type: string
      required: false
    X-Amz-Algorithm:
      name: X-Amz-Algorithm
      in: header
      schema:
        type: string
      required: false
    X-Amz-Credential:
      name: X-Amz-Credential
      in: header
      schema:
        type: string
      required: false
    X-Amz-Security-Token:
      name: X-Amz-Security-Token
      in: header
      schema:
        type: string
      required: false
    X-Amz-Content-Sha256:
      name: X-Amz-Content-Sha256
      in: header
      schema:
        type: string
      required: false
    X-Amz-Date:
      name: X-Amz-Date
      in: header
      schema:
        type: string
      required: false
  schemas:
    AuthResult:
      type: object
      properties:
        authInfo:
          allOf:
          - $ref: '#/components/schemas/AuthInfo'
          - description: Authorization information.
        allowed:
          allOf:
          - $ref: '#/components/schemas/Allowed'
          - description: The policies and statements that allowed the specified action.
        denied:
          allOf:
          - $ref: '#/components/schemas/Denied'
          - description: The policies and statements that denied the specified action.
        authDecision:
          allOf:
          - $ref: '#/components/schemas/AuthDecision'
          - description: The final authorization decision of this scenario. Multiple statements are taken into account when determining the authorization decision. An explicit deny statement can override multiple allow statements.
        missingContextValues:
          allOf:
          - $ref: '#/components/schemas/MissingContextValues'
          - description: Contains any missing context values found while evaluating policy.
      description: The authorizer result.
    Resource:
      type: string
      pattern: '[\s\S]*'
      maxLength: 2048
    ThrottlingException: {}
    Policies:
      type: array
      items:
        $ref: '#/components/schemas/Policy'
    AuthDecision:
      type: string
      enum:
      - ALLOWED
      - EXPLICIT_DENY
      - IMPLICIT_DENY
    Resources:
      type: array
      items:
        $ref: '#/components/schemas/Resource'
    TestAuthorizationResponse:
      type: object
      properties:
        authResults:
          allOf:
          - $ref: '#/components/schemas/AuthResults'
          - description: The authentication results.
    PolicyName:
      type: string
      pattern: '[\w+=,.@-]+'
      minLength: 1
      maxLength: 128
    ServiceUnavailableException: {}
    MissingContextValues:
      type: array
      items:
        $ref: '#/components/schemas/MissingContextValue'
    InternalFailureException: {}
    AuthResults:
      type: array
      items:
        $ref: '#/components/schemas/AuthResult'
    Denied:
      type: object
      properties:
        implicitDeny:
          allOf:
          - $ref: '#/components/schemas/ImplicitDeny'
          - description: Information that implicitly denies the authorization. When a policy doesn't explicitly deny or allow an action on a resource it is considered an implicit deny.
        explicitDeny:
          allOf:
          - $ref: '#/components/schemas/ExplicitDeny'
          - description: 'Information that explicitly denies the authorization. '
      description: Contains information that denied the authorization.
    ExplicitDeny:
      type: object
      properties:
        policies:
          allOf:
          - $ref: '#/components/schemas/Policies'
          - description: The policies that denied the authorization.
      description: Information that explicitly denies authorization.
    UnauthorizedException: {}
    Policy:
      type: object
      properties:
        policyName:
          allOf:
          - $ref: '#/components/schemas/PolicyName'
          - description: The policy name.
        policyArn:
          allOf:
          - $ref: '#/components/schemas/PolicyArn'
          - description: The policy ARN.
      description: Describes an IoT policy.
    MissingContextValue:
      type: string
    InvalidRequestException: {}
    PolicyArn:
      type: string
    ImplicitDeny:
      type: object
      properties:
        policies:
          allOf:
          - $ref: '#/components/schemas/Policies'
          - description: 'Policies that don''t contain a matching allow or deny statement for the specified action on the specified resource. '
      description: Information that implicitly denies authorization. When policy doesn't explicitly deny or allow an action on a resource it is considered an implicit deny.
    ResourceNotFoundException: {}
    LimitExceededException: {}
    Allowed:
      type: object
      properties:
        policies:
          allOf:
          - $ref: '#/components/schemas/Policies'
          - description: A list of policies that allowed the authentication.
      description: Contains information that allowed the authorization.
    ActionType:
      type: string
      enum:
      - PUBLISH
      - SUBSCRIBE
      - RECEIVE
      - CONNECT
    AuthInfo:
      type: object
      required:
      - resources
      properties:
        actionType:
          allOf:
          - $ref: '#/components/schemas/ActionType'
          - description: The type of action for which the principal is being authorized.
        resources:
          allOf:
          - $ref: '#/components/schemas/Resources'
          - description: The resources for which the principal is being authorized to perform the specified action.
      description: A collection of authorization information.
  securitySchemes:
    hmac:
      type: apiKey
      name: Authorization
      in: header
      description: Amazon Signature authorization v4
      x-amazon-apigateway-authtype: awsSigv4
externalDocs:
  description: Amazon Web Services documentation
  url: https://docs.aws.amazon.com/iot/
x-hasEquivalentPaths: true