Amazon Organizations Organizations Delegated Administrator API

openapi: 3.2.0
info:
  title: AWS Organizations Delegated Administrator API
  version: '2016-11-28'
  description: Generated from AWS's published Smithy model for AWS Organizations. 3 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://organizations.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Delegated Administrator
paths:
  /#DeregisterDelegatedAdministrator:
    post:
      operationId: DeregisterDelegatedAdministrator
      summary: Deregister Delegated Administrator
      description: Removes the specified member Amazon Web Services account as a delegated administrator for the specified Amazon Web Services service. Deregistering a delegated administrator can have unintended impacts on the functionality of the enabled Amazon Web Services service. See the documentation for the enabled service before you deregister a delegated administrator so that you understand any potential impacts. You can run this action only for Amazon Web Services services that support this feature. For a current list of services that support it, see the column Supports Delegated Administrator in the table at Amazon Web Services Services that you can use with Organizations in the Organizations User Guide. You can only call this operation from the management account.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '403':
          description: AccessDeniedException; UnsupportedAPIEndpointException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '404':
          description: AccountNotFoundException; AWSOrganizationsNotInUseException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccountNotFoundException'
        '409':
          description: AccountNotRegisteredException; ConcurrentModificationException; ConstraintViolationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccountNotRegisteredException'
        '400':
          description: InvalidInputException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '500':
          description: ServiceException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ServiceException'
        '429':
          description: TooManyRequestsException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/TooManyRequestsException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWSOrganizationsV20161128.DeregisterDelegatedAdministrator
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DeregisterDelegatedAdministratorRequest'
      tags:
      - Delegated Administrator
  /#ListDelegatedAdministrators:
    post:
      operationId: ListDelegatedAdministrators
      summary: List Delegated Administrators
      description: Lists the Amazon Web Services accounts that are designated as delegated administrators in this organization. You can only call this operation from the management account or a member account that is a delegated administrator.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ListDelegatedAdministratorsResponse'
        '403':
          description: AccessDeniedException; UnsupportedAPIEndpointException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '404':
          description: AWSOrganizationsNotInUseException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AWSOrganizationsNotInUseException'
        '409':
          description: ConstraintViolationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConstraintViolationException'
        '400':
          description: InvalidInputException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '500':
          description: ServiceException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ServiceException'
        '429':
          description: TooManyRequestsException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/TooManyRequestsException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWSOrganizationsV20161128.ListDelegatedAdministrators
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ListDelegatedAdministratorsRequest'
      tags:
      - Delegated Administrator
  /#RegisterDelegatedAdministrator:
    post:
      operationId: RegisterDelegatedAdministrator
      summary: Register Delegated Administrator
      description: Enables the specified member account to administer the Organizations features of the specified Amazon Web Services service. It grants read-only access to Organizations service data. The account still requires IAM permissions to access and administer the Amazon Web Services service. You can run this action only for Amazon Web Services services that support this feature. For a current list of services that support it, see the column Supports Delegated Administrator in the table at Amazon Web Services Services that you can use with Organizations in the Organizations User Guide. You can only call this operation from the management account.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '403':
          description: AccessDeniedException; UnsupportedAPIEndpointException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: AccountAlreadyRegisteredException; ConcurrentModificationException; ConstraintViolationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccountAlreadyRegisteredException'
        '404':
          description: AccountNotFoundException; AWSOrganizationsNotInUseException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccountNotFoundException'
        '400':
          description: InvalidInputException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '500':
          description: ServiceException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ServiceException'
        '429':
          description: TooManyRequestsException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/TooManyRequestsException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWSOrganizationsV20161128.RegisterDelegatedAdministrator
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/RegisterDelegatedAdministratorRequest'
      tags:
      - Delegated Administrator
components:
  schemas:
    InvalidInputException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - INVALID_PARTY_TYPE_TARGET
          - INVALID_SYNTAX_ORGANIZATION_ARN
          - INVALID_SYNTAX_POLICY_ID
          - INVALID_ENUM
          - INVALID_ENUM_POLICY_TYPE
          - INVALID_LIST_MEMBER
          - MAX_LENGTH_EXCEEDED
          - MAX_VALUE_EXCEEDED
          - MIN_LENGTH_EXCEEDED
          - MIN_VALUE_EXCEEDED
          - IMMUTABLE_POLICY
          - INVALID_PATTERN
          - INVALID_PATTERN_TARGET_ID
          - INPUT_REQUIRED
          - INVALID_NEXT_TOKEN
          - MAX_LIMIT_EXCEEDED_FILTER
          - MOVING_ACCOUNT_BETWEEN_DIFFERENT_ROOTS
          - INVALID_FULL_NAME_TARGET
          - UNRECOGNIZED_SERVICE_PRINCIPAL
          - INVALID_ROLE_NAME
          - INVALID_SYSTEM_TAGS_PARAMETER
          - DUPLICATE_TAG_KEY
          - TARGET_NOT_SUPPORTED
          - INVALID_EMAIL_ADDRESS_TARGET
          - INVALID_RESOURCE_POLICY_JSON
          - INVALID_PRINCIPAL
          - UNSUPPORTED_ACTION_IN_RESOURCE_POLICY
          - UNSUPPORTED_POLICY_TYPE_IN_RESOURCE_POLICY
          - UNSUPPORTED_RESOURCE_IN_RESOURCE_POLICY
          - NON_DETACHABLE_POLICY
          - CALLER_REQUIRED_FIELD_MISSING
          - UNSUPPORTED_ACTION_IN_RESPONSIBILITY_TRANSFER
          - START_DATE_NOT_BEGINNING_OF_MONTH
          - START_DATE_NOT_BEGINNING_OF_DAY
          - START_DATE_TOO_EARLY
          - START_DATE_TOO_LATE
          - INVALID_START_DATE
          - END_DATE_NOT_END_OF_MONTH
          - END_DATE_TOO_EARLY
          - END_DATE_TOO_LATE
          - INVALID_END_DATE
    AccountNotRegisteredException:
      type: object
      properties:
        Message:
          type: string
    ListDelegatedAdministratorsResponse:
      type: object
      properties:
        DelegatedAdministrators:
          type: array
          items:
            $ref: '#/components/schemas/DelegatedAdministrator'
          description: The list of delegated administrators in your organization.
        NextToken:
          type: string
          description: If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.
    AWSOrganizationsNotInUseException:
      type: object
      properties:
        Message:
          type: string
    DelegatedAdministrator:
      type: object
      properties:
        Id:
          type: string
          description: The unique identifier (ID) of the delegated administrator's account.
        Arn:
          type: string
          description: The Amazon Resource Name (ARN) of the delegated administrator's account.
        Email:
          type: string
          description: The email address that is associated with the delegated administrator's Amazon Web Services account.
        Name:
          type: string
          description: The friendly name of the delegated administrator's account.
        Status:
          type: string
          enum:
          - ACTIVE
          - SUSPENDED
          - PENDING_CLOSURE
          description: The status of the delegated administrator's account in the organization.
        State:
          type: string
          enum:
          - PENDING_ACTIVATION
          - ACTIVE
          - SUSPENDED
          - PENDING_CLOSURE
          - CLOSED
          description: Each state represents a specific phase in the account lifecycle. Use this information to manage account access, automate workflows, or trigger actions based on account state changes. For more information about account states and their implications, see Monitor the state of your Amazon Web Services accounts in the Organizations User Guide.
        JoinedMethod:
          type: string
          enum:
          - INVITED
          - CREATED
          description: The method by which the delegated administrator's account joined the organization.
        JoinedTimestamp:
          type: string
          format: date-time
          description: The date when the delegated administrator's account became a part of the organization.
        DelegationEnabledDate:
          type: string
          format: date-time
          description: The date when the account was made a delegated administrator.
    AccountAlreadyRegisteredException:
      type: object
      properties:
        Message:
          type: string
    ConstraintViolationException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - ACCOUNT_NUMBER_LIMIT_EXCEEDED
          - HANDSHAKE_RATE_LIMIT_EXCEEDED
          - OU_NUMBER_LIMIT_EXCEEDED
          - OU_DEPTH_LIMIT_EXCEEDED
          - POLICY_NUMBER_LIMIT_EXCEEDED
          - POLICY_CONTENT_LIMIT_EXCEEDED
          - MAX_POLICY_TYPE_ATTACHMENT_LIMIT_EXCEEDED
          - MIN_POLICY_TYPE_ATTACHMENT_LIMIT_EXCEEDED
          - ACCOUNT_CANNOT_LEAVE_ORGANIZATION
          - ACCOUNT_CANNOT_LEAVE_WITHOUT_EULA
          - ACCOUNT_CANNOT_LEAVE_WITHOUT_PHONE_VERIFICATION
          - MASTER_ACCOUNT_PAYMENT_INSTRUMENT_REQUIRED
          - MEMBER_ACCOUNT_PAYMENT_INSTRUMENT_REQUIRED
          - ACCOUNT_CREATION_RATE_LIMIT_EXCEEDED
          - MASTER_ACCOUNT_ADDRESS_DOES_NOT_MATCH_MARKETPLACE
          - MASTER_ACCOUNT_MISSING_CONTACT_INFO
          - MASTER_ACCOUNT_NOT_GOVCLOUD_ENABLED
          - ORGANIZATION_NOT_IN_ALL_FEATURES_MODE
          - CREATE_ORGANIZATION_IN_BILLING_MODE_UNSUPPORTED_REGION
          - EMAIL_VERIFICATION_CODE_EXPIRED
          - WAIT_PERIOD_ACTIVE
          - MAX_TAG_LIMIT_EXCEEDED
          - TAG_POLICY_VIOLATION
          - MAX_DELEGATED_ADMINISTRATORS_FOR_SERVICE_LIMIT_EXCEEDED
          - CANNOT_REGISTER_MASTER_AS_DELEGATED_ADMINISTRATOR
          - CANNOT_REMOVE_DELEGATED_ADMINISTRATOR_FROM_ORG
          - DELEGATED_ADMINISTRATOR_EXISTS_FOR_THIS_SERVICE
          - POLICY_TYPE_ENABLED_FOR_THIS_SERVICE
          - MASTER_ACCOUNT_MISSING_BUSINESS_LICENSE
          - CANNOT_CLOSE_MANAGEMENT_ACCOUNT
          - CLOSE_ACCOUNT_QUOTA_EXCEEDED
          - CLOSE_ACCOUNT_REQUESTS_LIMIT_EXCEEDED
          - SERVICE_ACCESS_NOT_ENABLED
          - INVALID_PAYMENT_INSTRUMENT
          - ACCOUNT_CREATION_NOT_COMPLETE
          - CANNOT_REGISTER_SUSPENDED_ACCOUNT_AS_DELEGATED_ADMINISTRATOR
          - ALL_FEATURES_MIGRATION_ORGANIZATION_SIZE_LIMIT_EXCEEDED
          - RESPONSIBILITY_TRANSFER_MAX_LEVEL_VIOLATION
          - RESPONSIBILITY_TRANSFER_MAX_INBOUND_QUOTA_VIOLATION
          - RESPONSIBILITY_TRANSFER_MAX_OUTBOUND_QUOTA_VIOLATION
          - RESPONSIBILITY_TRANSFER_MAX_TRANSFERS_QUOTA_VIOLATION
          - ACTIVE_RESPONSIBILITY_TRANSFER_PROCESS
          - TRANSFER_RESPONSIBILITY_TARGET_DELETION_IN_PROGRESS
          - TRANSFER_RESPONSIBILITY_SOURCE_DELETION_IN_PROGRESS
          - UNSUPPORTED_PRICING
          - UNMET_BILLING_PREREQUISITE
          - ACCOUNT_NOT_ACTIVE_FOR_TRANSFER_RESPONSIBILITY
          - TRANSFER_RESPONSIBILITY_UPDATE_NOT_ALLOWED
    TooManyRequestsException:
      type: object
      properties:
        Type:
          type: string
        Message:
          type: string
    AccessDeniedException:
      type: object
      properties:
        Message:
          type: string
    AccountNotFoundException:
      type: object
      properties:
        Message:
          type: string
    DeregisterDelegatedAdministratorRequest:
      type: object
      properties:
        AccountId:
          type: string
          description: The account ID number of the member account in the organization that you want to deregister as a delegated administrator.
        ServicePrincipal:
          type: string
          description: The service principal name of an Amazon Web Services service for which the account is a delegated administrator. Delegated administrator privileges are revoked for only the specified Amazon Web Services service from the member account. If the specified service is the only service for which the member account is a delegated administrator, the operation also revokes Organizations read action permissions.
      required:
      - AccountId
      - ServicePrincipal
    ServiceException:
      type: object
      properties:
        Message:
          type: string
    ListDelegatedAdministratorsRequest:
      type: object
      properties:
        ServicePrincipal:
          type: string
          description: Specifies a service principal name. If specified, then the operation lists the delegated administrators only for the specified service. If you don't specify a service principal, the operation lists all delegated administrators for all services in your organization.
        NextToken:
          type: string
          description: The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.
        MaxResults:
          type: integer
          description: The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.
    RegisterDelegatedAdministratorRequest:
      type: object
      properties:
        AccountId:
          type: string
          description: The account ID number of the member account in the organization to register as a delegated administrator.
        ServicePrincipal:
          type: string
          description: The service principal of the Amazon Web Services service for which you want to make the member account a delegated administrator.
      required:
      - AccountId
      - ServicePrincipal
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: organizations
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/organizations/service/2016-11-28/organizations-2016-11-28.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)