AWS Security Hub

AWS Security Hub Security Hub Associations API

The Security Hub Associations API from AWS Security Hub — 2 operation(s) for security hub associations.

GitHub OpenAPI
Business capability
Security Strategy & Governance Management BC-620.10

Operations 3

POST /associations/batchGet Batch Get Standards Control Associations #
PATCH /associations Batch Update Standards Control Associations #
GET /associations List Standards Control Associations #

Specifications

⚙
OpenAPI
https://artifacts.apis.io/aws-security-hub/openapi/aws-security-hub-associations-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/aws-security-hub:aws-security-hub-associations-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

aws-security-hub-associations-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: AWS SecurityHub Associations API
  version: '2018-10-26'
  description: Generated from AWS's published Smithy model for AWS SecurityHub. 3 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://securityhub.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Associations
paths:
  /associations/batchGet:
    post:
      operationId: BatchGetStandardsControlAssociations
      summary: Batch Get Standards Control Associations
      description: For a batch of security controls and standards, identifies whether each control is currently enabled or disabled in a standard. Calls to this operation return a RESOURCE_NOT_FOUND_EXCEPTION error when the standard subscription for the association has a NOT_READY_FOR_UPDATES value for StandardsControlsUpdatable.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BatchGetStandardsControlAssociationsResponse'
        '500':
          description: InternalException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalException'
        '401':
          description: InvalidAccessException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidAccessException'
        '400':
          description: InvalidInputException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '429':
          description: LimitExceededException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LimitExceededException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BatchGetStandardsControlAssociationsRequest'
      tags:
      - Associations
  /associations:
    patch:
      operationId: BatchUpdateStandardsControlAssociations
      summary: Batch Update Standards Control Associations
      description: For a batch of security controls and standards, this operation updates the enablement status of a control in a standard.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BatchUpdateStandardsControlAssociationsResponse'
              example:
                UnprocessedAssociationUpdates:
                - ErrorCode: INVALID_INPUT
                  ErrorReason: 'Invalid Standards Arn: ''arn:aws:securityhub:::ruleset/sample-standard/v/1.1.0'''
                  StandardsControlAssociationUpdate:
                    AssociationStatus: DISABLED
                    SecurityControlId: CloudTrail.1
                    StandardsArn: arn:aws:securityhub:::ruleset/sample-standard/v/1.1.0
                    UpdatedReason: Test Reason
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalException'
        '401':
          description: InvalidAccessException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidAccessException'
        '400':
          description: InvalidInputException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '429':
          description: LimitExceededException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LimitExceededException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BatchUpdateStandardsControlAssociationsRequest'
            example:
              StandardsControlAssociationUpdates:
              - SecurityControlId: CloudTrail.1
                StandardsArn: arn:aws:securityhub:::ruleset/sample-standard/v/1.1.0
                AssociationStatus: DISABLED
                UpdatedReason: Not relevant to environment
              - SecurityControlId: CloudWatch.12
                StandardsArn: arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0
                AssociationStatus: DISABLED
                UpdatedReason: Not relevant to environment
      tags:
      - Associations
    get:
      operationId: ListStandardsControlAssociations
      summary: List Standards Control Associations
      description: Specifies whether a control is currently enabled or disabled in each enabled standard in the calling account. This operation omits standards control associations for standard subscriptions where StandardsControlsUpdatable has value NOT_READY_FOR_UPDATES.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListStandardsControlAssociationsResponse'
        '500':
          description: InternalException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalException'
        '401':
          description: InvalidAccessException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidAccessException'
        '400':
          description: InvalidInputException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '429':
          description: LimitExceededException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LimitExceededException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListStandardsControlAssociationsRequest'
      tags:
      - Associations
components:
  schemas:
    StandardsControlAssociationId:
      type: object
      properties:
        SecurityControlId:
          type: string
          description: The unique identifier (identified with SecurityControlId, SecurityControlArn, or a mix of both parameters) of a security control across standards.
        StandardsArn:
          type: string
          description: The ARN of a standard.
      required:
      - SecurityControlId
      - StandardsArn
    StandardsControlAssociationSummary:
      type: object
      properties:
        StandardsArn:
          type: string
          description: The Amazon Resource Name (ARN) of a standard.
        SecurityControlId:
          type: string
          description: A unique standard-agnostic identifier for a control. Values for this field typically consist of an Amazon Web Services service and a number, such as APIGateway.5. This field doesn't reference a specific standard.
        SecurityControlArn:
          type: string
          description: The ARN of a control, such as arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1. This parameter doesn't mention a specific standard.
        AssociationStatus:
          type: string
          enum:
          - ENABLED
          - DISABLED
          description: The enablement status of a control in a specific standard.
        RelatedRequirements:
          type: array
          items:
            type: string
          description: The requirement that underlies this control in the compliance framework related to the standard.
        UpdatedAt:
          type: string
          format: date-time
          description: The last time that a control's enablement status in a specified standard was updated.
        UpdatedReason:
          type: string
          description: The reason for updating a control's enablement status in a specified standard.
        StandardsControlTitle:
          type: string
          description: The title of a control.
        StandardsControlDescription:
          type: string
          description: The description of a control. This typically summarizes how Security Hub CSPM evaluates the control and the conditions under which it produces a failed finding. The parameter may reference a specific standard.
      required:
      - StandardsArn
      - SecurityControlId
      - SecurityControlArn
      - AssociationStatus
    InvalidInputException:
      type: object
      properties:
        Message:
          type: string
        Code:
          type: string
    BatchGetStandardsControlAssociationsResponse:
      type: object
      properties:
        StandardsControlAssociationDetails:
          type: array
          items:
            $ref: '#/components/schemas/StandardsControlAssociationDetail'
          description: Provides the enablement status of a security control in a specified standard and other details for the control in relation to the specified standard.
        UnprocessedAssociations:
          type: array
          items:
            $ref: '#/components/schemas/UnprocessedStandardsControlAssociation'
          description: A security control (identified with SecurityControlId, SecurityControlArn, or a mix of both parameters) whose enablement status in a specified standard cannot be returned.
      required:
      - StandardsControlAssociationDetails
    StandardsControlAssociationUpdate:
      type: object
      properties:
        StandardsArn:
          type: string
          description: The Amazon Resource Name (ARN) of the standard in which you want to update the control's enablement status.
        SecurityControlId:
          type: string
          description: The unique identifier for the security control whose enablement status you want to update.
        AssociationStatus:
          type: string
          enum:
          - ENABLED
          - DISABLED
          description: The desired enablement status of the control in the standard.
        UpdatedReason:
          type: string
          description: The reason for updating the control's enablement status in the standard.
      required:
      - StandardsArn
      - SecurityControlId
      - AssociationStatus
    UnprocessedStandardsControlAssociationUpdate:
      type: object
      properties:
        StandardsControlAssociationUpdate:
          $ref: '#/components/schemas/StandardsControlAssociationUpdate'
        ErrorCode:
          type: string
          enum:
          - INVALID_INPUT
          - ACCESS_DENIED
          - NOT_FOUND
          - RESOURCE_NOT_FOUND
          - LIMIT_EXCEEDED
          description: The error code for the unprocessed update of the control's enablement status in the specified standard. The NOT_FOUND value has been deprecated and replaced by the RESOURCE_NOT_FOUND value.
        ErrorReason:
          type: string
          description: The reason why a control's enablement status in the specified standard couldn't be updated.
      required:
      - StandardsControlAssociationUpdate
      - ErrorCode
    BatchUpdateStandardsControlAssociationsRequest:
      type: object
      properties:
        StandardsControlAssociationUpdates:
          type: array
          items:
            $ref: '#/components/schemas/StandardsControlAssociationUpdate'
          description: Updates the enablement status of a security control in a specified standard. Calls to this operation return a RESOURCE_NOT_FOUND_EXCEPTION error when the standard subscription for the control has StandardsControlsUpdatable value NOT_READY_FOR_UPDATES.
      required:
      - StandardsControlAssociationUpdates
    BatchGetStandardsControlAssociationsRequest:
      type: object
      properties:
        StandardsControlAssociationIds:
          type: array
          items:
            $ref: '#/components/schemas/StandardsControlAssociationId'
          description: An array with one or more objects that includes a security control (identified with SecurityControlId, SecurityControlArn, or a mix of both parameters) and the Amazon Resource Name (ARN) of a standard. This field is used to query the enablement status of a control in a specified standard. The security control ID or ARN is the same across standards.
      required:
      - StandardsControlAssociationIds
    StandardsControlAssociationDetail:
      type: object
      properties:
        StandardsArn:
          type: string
          description: The Amazon Resource Name (ARN) of a security standard.
        SecurityControlId:
          type: string
          description: The unique identifier of a security control across standards. Values for this field typically consist of an Amazon Web Services service name and a number, such as APIGateway.3.
        SecurityControlArn:
          type: string
          description: The ARN of a security control across standards, such as arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1. This parameter doesn't mention a specific standard.
        AssociationStatus:
          type: string
          enum:
          - ENABLED
          - DISABLED
          description: Specifies whether a control is enabled or disabled in a specified standard.
        RelatedRequirements:
          type: array
          items:
            type: string
          description: The requirement that underlies a control in the compliance framework related to the standard.
        UpdatedAt:
          type: string
          format: date-time
          description: The time at which the enablement status of the control in the specified standard was last updated.
        UpdatedReason:
          type: string
          description: The reason for updating the enablement status of a control in a specified standard.
        StandardsControlTitle:
          type: string
          description: The title of a control. This field may reference a specific standard.
        StandardsControlDescription:
          type: string
          description: The description of a control. This typically summarizes how Security Hub CSPM evaluates the control and the conditions under which it produces a failed finding. This parameter may reference a specific standard.
        StandardsControlArns:
          type: array
          items:
            type: string
          description: Provides the input parameter that Security Hub CSPM uses to call the UpdateStandardsControl API. This API can be used to enable or disable a control in a specified standard.
      required:
      - StandardsArn
      - SecurityControlId
      - SecurityControlArn
      - AssociationStatus
    ListStandardsControlAssociationsResponse:
      type: object
      properties:
        StandardsControlAssociationSummaries:
          type: array
          items:
            $ref: '#/components/schemas/StandardsControlAssociationSummary'
          description: An array that provides the enablement status and other details for each security control that applies to each enabled standard.
        NextToken:
          type: string
          description: A pagination parameter that's included in the response only if it was included in the request.
      required:
      - StandardsControlAssociationSummaries
    BatchUpdateStandardsControlAssociationsResponse:
      type: object
      properties:
        UnprocessedAssociationUpdates:
          type: array
          items:
            $ref: '#/components/schemas/UnprocessedStandardsControlAssociationUpdate'
          description: A security control (identified with SecurityControlId, SecurityControlArn, or a mix of both parameters) whose enablement status in a specified standard couldn't be updated.
    LimitExceededException:
      type: object
      properties:
        Message:
          type: string
        Code:
          type: string
    InternalException:
      type: object
      properties:
        Message:
          type: string
        Code:
          type: string
    UnprocessedStandardsControlAssociation:
      type: object
      properties:
        StandardsControlAssociationId:
          $ref: '#/components/schemas/StandardsControlAssociationId'
        ErrorCode:
          type: string
          enum:
          - INVALID_INPUT
          - ACCESS_DENIED
          - NOT_FOUND
          - RESOURCE_NOT_FOUND
          - LIMIT_EXCEEDED
          description: The error code for the unprocessed standard and control association. The NOT_FOUND value has been deprecated and replaced by the RESOURCE_NOT_FOUND value.
        ErrorReason:
          type: string
          description: The reason why the standard and control association was unprocessed.
      required:
      - StandardsControlAssociationId
      - ErrorCode
    ListStandardsControlAssociationsRequest:
      type: object
      properties:
        SecurityControlId:
          type: string
          description: The identifier of the control (identified with SecurityControlId, SecurityControlArn, or a mix of both parameters) that you want to determine the enablement status of in each enabled standard.
        NextToken:
          type: string
          description: Optional pagination parameter.
        MaxResults:
          type: integer
          description: An optional parameter that limits the total results of the API response to the specified number. If this parameter isn't provided in the request, the results include the first 25 standard and control associations. The results also include a NextToken parameter that you can use in a subsequent API call to get the next 25 associations. This repeats until all associations for the specified control are returned. The number of results is limited by the number of supported Security Hub CSPM standards that you've enabled in the calling account.
      required:
      - SecurityControlId
    AccessDeniedException:
      type: object
      properties:
        Message:
          type: string
        Code:
          type: string
    InvalidAccessException:
      type: object
      properties:
        Message:
          type: string
        Code:
          type: string
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: securityhub
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/securityhub/service/2018-10-26/securityhub-2018-10-26.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)