Amazon SageMaker Sagemaker Workforce API

openapi: 3.1.0
info:
  title: Amazon SageMaker Service Workforce API
  version: '2017-07-24'
  description: Generated from AWS's published Smithy model for Amazon SageMaker Service. 5 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://api.sagemaker.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
paths:
  /#CreateWorkforce:
    post:
      operationId: CreateWorkforce
      summary: Create Workforce
      description: Use this operation to create a workforce. This operation will return an error if a workforce already exists
        in the Amazon Web Services Region that you specify. You can only create one workforce in each Amazon Web Services
        Region per Amazon Web Services account. If you want to create a new workforce in an Amazon Web Services Region where
        a workforce already exists, use the DeleteWorkforce API operation to delete the existing workforce and then use CreateWorkforce
        to create a new workforce. To create a private workforce using Amazon Cognito, you must specify a Cognito user pool
        in CognitoConfig. You can also create an Amazon Cognito workforce using the Amazon SageMaker console. For more information,
        see Create a Private Workforce (Amazon Cognito). To create a private workforce using your own OIDC Identity Provider
        (IdP), specify your IdP configuration in OidcConfig. Your OIDC IdP must support groups because groups are used by
        Ground Truth and Amazon A2I to create work teams. For more information, see Create a Private Workforce (OIDC IdP).
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/CreateWorkforceResponse'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SageMaker.CreateWorkforce
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/CreateWorkforceRequest'
      tags:
      - Workforce
  /#DeleteWorkforce:
    post:
      operationId: DeleteWorkforce
      summary: Delete Workforce
      description: Use this operation to delete a workforce. If you want to create a new workforce in an Amazon Web Services
        Region where a workforce already exists, use this operation to delete the existing workforce and then use CreateWorkforce
        to create a new workforce. If a private workforce contains one or more work teams, you must use the DeleteWorkteam
        operation to delete all work teams before you delete the workforce. If you try to delete a workforce that contains
        one or more work teams, you will receive a ResourceInUse error.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DeleteWorkforceResponse'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SageMaker.DeleteWorkforce
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DeleteWorkforceRequest'
      tags:
      - Workforce
  /#DescribeWorkforce:
    post:
      operationId: DescribeWorkforce
      summary: Describe Workforce
      description: Lists private workforce information, including workforce name, Amazon Resource Name (ARN), and, if applicable,
        allowed IP address ranges (CIDRs). Allowable IP address ranges are the IP addresses that workers can use to access
        tasks. This operation applies only to private workforces.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DescribeWorkforceResponse'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SageMaker.DescribeWorkforce
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DescribeWorkforceRequest'
      tags:
      - Workforce
  /#ListWorkforces:
    post:
      operationId: ListWorkforces
      summary: List Workforces
      description: Use this operation to list all private and vendor workforces in an Amazon Web Services Region. Note that
        you can only have one private workforce per Amazon Web Services Region.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ListWorkforcesResponse'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SageMaker.ListWorkforces
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ListWorkforcesRequest'
      tags:
      - Workforce
  /#UpdateWorkforce:
    post:
      operationId: UpdateWorkforce
      summary: Update Workforce
      description: 'Use this operation to update your workforce. You can use this operation to require that workers use specific
        IP addresses to work on tasks and to update your OpenID Connect (OIDC) Identity Provider (IdP) workforce configuration.
        The worker portal is now supported in VPC and public internet. Use SourceIpConfig to restrict worker access to tasks
        to a specific range of IP addresses. You specify allowed IP addresses by creating a list of up to ten CIDRs. By default,
        a workforce isn''t restricted to specific IP addresses. If you specify a range of IP addresses, workers who attempt
        to access tasks using any IP address outside the specified range are denied and get a Not Found error message on the
        worker portal. To restrict public internet access for all workers, configure the SourceIpConfig CIDR value. For example,
        when using SourceIpConfig with an IpAddressType of IPv4, you can restrict access to the IPv4 CIDR block "10.0.0.0/16".
        When using an IpAddressType of dualstack, you can specify both the IPv4 and IPv6 CIDR blocks, such as "10.0.0.0/16"
        for IPv4 only, "2001:db8:1234:1a00::/56" for IPv6 only, or "10.0.0.0/16" and "2001:db8:1234:1a00::/56" for dual stack.
        Amazon SageMaker does not '
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/UpdateWorkforceResponse'
        '400':
          description: ConflictException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConflictException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - SageMaker.UpdateWorkforce
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/UpdateWorkforceRequest'
      tags:
      - Workforce
components:
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical
        request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: sagemaker
  schemas:
    CognitoConfig:
      type: object
      properties:
        UserPool:
          type: string
          description: A user pool is a user directory in Amazon Cognito. With a user pool, your users can sign in to your
            web or mobile app through Amazon Cognito. Your users can also sign in through social identity providers like Google,
            Facebook, Amazon, or Apple, and through SAML identity providers.
        ClientId:
          type: string
          description: The client ID for your Amazon Cognito user pool.
      required:
      - UserPool
      - ClientId
    ConflictException:
      type: object
      properties:
        Message:
          type: string
    CreateWorkforceRequest:
      type: object
      properties:
        CognitoConfig:
          $ref: '#/components/schemas/CognitoConfig'
        OidcConfig:
          $ref: '#/components/schemas/OidcConfig'
        SourceIpConfig:
          $ref: '#/components/schemas/SourceIpConfig'
        WorkforceName:
          type: string
          description: The name of the private workforce.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: An array of key-value pairs that contain metadata to help you categorize and organize our workforce.
            Each tag consists of a key and a value, both of which you define.
        WorkforceVpcConfig:
          $ref: '#/components/schemas/WorkforceVpcConfigRequest'
        IpAddressType:
          type: string
          enum:
          - ipv4
          - dualstack
          description: Use this parameter to specify whether you want IPv4 only or dualstack (IPv4 and IPv6) to support your
            labeling workforce.
      required:
      - WorkforceName
    CreateWorkforceResponse:
      type: object
      properties:
        WorkforceArn:
          type: string
          description: The Amazon Resource Name (ARN) of the workforce.
      required:
      - WorkforceArn
    DeleteWorkforceRequest:
      type: object
      properties:
        WorkforceName:
          type: string
          description: The name of the workforce.
      required:
      - WorkforceName
    DeleteWorkforceResponse:
      type: object
      properties: {}
    DescribeWorkforceRequest:
      type: object
      properties:
        WorkforceName:
          type: string
          description: The name of the private workforce whose access you want to restrict. WorkforceName is automatically
            set to default when a workforce is created and cannot be modified.
      required:
      - WorkforceName
    DescribeWorkforceResponse:
      type: object
      properties:
        Workforce:
          $ref: '#/components/schemas/Workforce'
      required:
      - Workforce
    ListWorkforcesRequest:
      type: object
      properties:
        SortBy:
          type: string
          enum:
          - Name
          - CreateDate
          description: Sort workforces using the workforce name or creation date.
        SortOrder:
          type: string
          enum:
          - Ascending
          - Descending
          description: Sort workforces in ascending or descending order.
        NameContains:
          type: string
          description: A filter you can use to search for workforces using part of the workforce name.
        NextToken:
          type: string
          description: A token to resume pagination.
        MaxResults:
          type: integer
          description: The maximum number of workforces returned in the response.
    ListWorkforcesResponse:
      type: object
      properties:
        Workforces:
          type: array
          items:
            $ref: '#/components/schemas/Workforce'
          description: A list containing information about your workforce.
        NextToken:
          type: string
          description: A token to resume pagination.
      required:
      - Workforces
    OidcConfig:
      type: object
      properties:
        ClientId:
          type: string
          description: The OIDC IdP client ID used to configure your private workforce.
        ClientSecret:
          type: string
          description: The OIDC IdP client secret used to configure your private workforce.
        Issuer:
          type: string
          description: The OIDC IdP issuer used to configure your private workforce.
        AuthorizationEndpoint:
          type: string
          description: The OIDC IdP authorization endpoint used to configure your private workforce.
        TokenEndpoint:
          type: string
          description: The OIDC IdP token endpoint used to configure your private workforce.
        UserInfoEndpoint:
          type: string
          description: The OIDC IdP user information endpoint used to configure your private workforce.
        LogoutEndpoint:
          type: string
          description: The OIDC IdP logout endpoint used to configure your private workforce.
        JwksUri:
          type: string
          description: The OIDC IdP JSON Web Key Set (Jwks) URI used to configure your private workforce.
        Scope:
          type: string
          description: An array of string identifiers used to refer to the specific pieces of user data or claims that the
            client application wants to access.
        AuthenticationRequestExtraParams:
          type: object
          additionalProperties:
            type: string
          description: A string to string map of identifiers specific to the custom identity provider (IdP) being used.
      required:
      - ClientId
      - ClientSecret
      - Issuer
      - AuthorizationEndpoint
      - TokenEndpoint
      - UserInfoEndpoint
      - LogoutEndpoint
      - JwksUri
    OidcConfigForResponse:
      type: object
      properties:
        ClientId:
          type: string
          description: The OIDC IdP client ID used to configure your private workforce.
        Issuer:
          type: string
          description: The OIDC IdP issuer used to configure your private workforce.
        AuthorizationEndpoint:
          type: string
          description: The OIDC IdP authorization endpoint used to configure your private workforce.
        TokenEndpoint:
          type: string
          description: The OIDC IdP token endpoint used to configure your private workforce.
        UserInfoEndpoint:
          type: string
          description: The OIDC IdP user information endpoint used to configure your private workforce.
        LogoutEndpoint:
          type: string
          description: The OIDC IdP logout endpoint used to configure your private workforce.
        JwksUri:
          type: string
          description: The OIDC IdP JSON Web Key Set (Jwks) URI used to configure your private workforce.
        Scope:
          type: string
          description: An array of string identifiers used to refer to the specific pieces of user data or claims that the
            client application wants to access.
        AuthenticationRequestExtraParams:
          type: object
          additionalProperties:
            type: string
          description: A string to string map of identifiers specific to the custom identity provider (IdP) being used.
    SourceIpConfig:
      type: object
      properties:
        Cidrs:
          type: array
          items:
            type: string
          description: 'A list of one to ten Classless Inter-Domain Routing (CIDR) values. Maximum: Ten CIDR values The following
            Length Constraints apply to individual CIDR values in the CIDR value list.'
      required:
      - Cidrs
    Tag:
      type: object
      properties:
        Key:
          type: string
          description: The tag key. Tag keys must be unique per resource.
        Value:
          type: string
          description: The tag value.
      required:
      - Key
      - Value
    UpdateWorkforceRequest:
      type: object
      properties:
        WorkforceName:
          type: string
          description: The name of the private workforce that you want to update. You can find your workforce name by using
            the ListWorkforces operation.
        SourceIpConfig:
          $ref: '#/components/schemas/SourceIpConfig'
        OidcConfig:
          $ref: '#/components/schemas/OidcConfig'
        WorkforceVpcConfig:
          $ref: '#/components/schemas/WorkforceVpcConfigRequest'
        IpAddressType:
          type: string
          enum:
          - ipv4
          - dualstack
          description: Use this parameter to specify whether you want IPv4 only or dualstack (IPv4 and IPv6) to support your
            labeling workforce.
      required:
      - WorkforceName
    UpdateWorkforceResponse:
      type: object
      properties:
        Workforce:
          $ref: '#/components/schemas/Workforce'
      required:
      - Workforce
    Workforce:
      type: object
      properties:
        WorkforceName:
          type: string
          description: The name of the private workforce.
        WorkforceArn:
          type: string
          description: The Amazon Resource Name (ARN) of the private workforce.
        LastUpdatedDate:
          type: string
          format: date-time
          description: The most recent date that UpdateWorkforce was used to successfully add one or more IP address ranges
            (CIDRs) to a private workforce's allow list.
        SourceIpConfig:
          $ref: '#/components/schemas/SourceIpConfig'
        SubDomain:
          type: string
          description: The subdomain for your OIDC Identity Provider.
        CognitoConfig:
          $ref: '#/components/schemas/CognitoConfig'
        OidcConfig:
          $ref: '#/components/schemas/OidcConfigForResponse'
        CreateDate:
          type: string
          format: date-time
          description: The date that the workforce is created.
        WorkforceVpcConfig:
          $ref: '#/components/schemas/WorkforceVpcConfigResponse'
        Status:
          type: string
          enum:
          - Initializing
          - Updating
          - Deleting
          - Failed
          - Active
          description: The status of your workforce.
        FailureReason:
          type: string
          description: The reason your workforce failed.
        IpAddressType:
          type: string
          enum:
          - ipv4
          - dualstack
          description: The IP address type you specify - either IPv4 only or dualstack (IPv4 and IPv6) - to support your labeling
            workforce.
      required:
      - WorkforceName
      - WorkforceArn
    WorkforceVpcConfigRequest:
      type: object
      properties:
        VpcId:
          type: string
          description: The ID of the VPC that the workforce uses for communication.
        SecurityGroupIds:
          type: array
          items:
            type: string
          description: The VPC security group IDs, in the form sg-xxxxxxxx. The security groups must be for the same VPC as
            specified in the subnet.
        Subnets:
          type: array
          items:
            type: string
          description: The ID of the subnets in the VPC that you want to connect.
    WorkforceVpcConfigResponse:
      type: object
      properties:
        VpcId:
          type: string
          description: The ID of the VPC that the workforce uses for communication.
        SecurityGroupIds:
          type: array
          items:
            type: string
          description: The VPC security group IDs, in the form sg-xxxxxxxx. The security groups must be for the same VPC as
            specified in the subnet.
        Subnets:
          type: array
          items:
            type: string
          description: The ID of the subnets in the VPC that you want to connect.
        VpcEndpointId:
          type: string
          description: The IDs for the VPC service endpoints of your VPC workforce when it is created and updated.
      required:
      - VpcId
      - SecurityGroupIds
      - Subnets
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/sagemaker/service/2017-07-24/sagemaker-2017-07-24.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)