AWS Security Hub Security Hub Master API

The Security Hub Master API from AWS Security Hub — 2 operation(s) for security hub master.

Operations 3

POST /master Accept Invitation #
GET /master Get Master Account #
POST /master/disassociate Disassociate From Master Account #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API
curl "https://apis.io/api/v1/apis/aws-security-hub:aws-security-hub-master-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

aws-security-hub-master-api-openapi.yml Raw ↑
openapi: 3.2.0
info:
  title: AWS SecurityHub Master API
  version: '2018-10-26'
  description: Generated from AWS's published Smithy model for AWS SecurityHub. 3 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://securityhub.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Master
paths:
  /master:
    post:
      operationId: AcceptInvitation
      summary: Accept Invitation
      description: This method is deprecated. Instead, use AcceptAdministratorInvitation. The Security Hub CSPM console continues to use AcceptInvitation. It will eventually change to use AcceptAdministratorInvitation. Any IAM policies that specifically control access to this function must continue to use AcceptInvitation. You should also add AcceptAdministratorInvitation to your policies to ensure that the correct permissions are in place after the console begins to use AcceptAdministratorInvitation. Accepts the invitation to be a member account and be monitored by the Security Hub CSPM administrator account that the invitation was sent from. This operation is only used by member accounts that are not added through Organizations. When the member account accepts the invitation, permission is granted to the administrator account to view findings generated in the member account.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AcceptInvitationResponse'
        '500':
          description: InternalException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalException'
        '401':
          description: InvalidAccessException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidAccessException'
        '400':
          description: InvalidInputException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '429':
          description: LimitExceededException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LimitExceededException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
      deprecated: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AcceptInvitationRequest'
      tags:
      - Master
    get:
      operationId: GetMasterAccount
      summary: Get Master Account
      description: This method is deprecated. Instead, use GetAdministratorAccount. The Security Hub CSPM console continues to use GetMasterAccount. It will eventually change to use GetAdministratorAccount. Any IAM policies that specifically control access to this function must continue to use GetMasterAccount. You should also add GetAdministratorAccount to your policies to ensure that the correct permissions are in place after the console begins to use GetAdministratorAccount. Provides the details for the Security Hub CSPM administrator account for the current member account. Can be used by both member accounts that are managed using Organizations and accounts that were invited manually.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetMasterAccountResponse'
        '500':
          description: InternalException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalException'
        '401':
          description: InvalidAccessException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidAccessException'
        '400':
          description: InvalidInputException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '429':
          description: LimitExceededException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LimitExceededException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
      deprecated: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetMasterAccountRequest'
      tags:
      - Master
  /master/disassociate:
    post:
      operationId: DisassociateFromMasterAccount
      summary: Disassociate From Master Account
      description: This method is deprecated. Instead, use DisassociateFromAdministratorAccount. The Security Hub CSPM console continues to use DisassociateFromMasterAccount. It will eventually change to use DisassociateFromAdministratorAccount. Any IAM policies that specifically control access to this function must continue to use DisassociateFromMasterAccount. You should also add DisassociateFromAdministratorAccount to your policies to ensure that the correct permissions are in place after the console begins to use DisassociateFromAdministratorAccount. Disassociates the current Security Hub CSPM member account from the associated administrator account. This operation is only used by accounts that are not part of an organization. For organization accounts, only the administrator account can disassociate a member account.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DisassociateFromMasterAccountResponse'
        '500':
          description: InternalException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalException'
        '401':
          description: InvalidAccessException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidAccessException'
        '400':
          description: InvalidInputException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidInputException'
        '429':
          description: LimitExceededException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LimitExceededException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
      deprecated: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DisassociateFromMasterAccountRequest'
      tags:
      - Master
components:
  schemas:
    AcceptInvitationRequest:
      type: object
      properties:
        MasterId:
          type: string
          description: The account ID of the Security Hub CSPM administrator account that sent the invitation.
        InvitationId:
          type: string
          description: The identifier of the invitation sent from the Security Hub CSPM administrator account.
      required:
      - MasterId
      - InvitationId
    InvalidInputException:
      type: object
      properties:
        Message:
          type: string
        Code:
          type: string
    GetMasterAccountRequest:
      type: object
      properties: {}
    ResourceNotFoundException:
      type: object
      properties:
        Message:
          type: string
        Code:
          type: string
    DisassociateFromMasterAccountResponse:
      type: object
      properties: {}
    InternalException:
      type: object
      properties:
        Message:
          type: string
        Code:
          type: string
    LimitExceededException:
      type: object
      properties:
        Message:
          type: string
        Code:
          type: string
    GetMasterAccountResponse:
      type: object
      properties:
        Master:
          $ref: '#/components/schemas/Invitation'
    AcceptInvitationResponse:
      type: object
      properties: {}
    Invitation:
      type: object
      properties:
        AccountId:
          type: string
          description: The account ID of the Security Hub CSPM administrator account that the invitation was sent from.
        InvitationId:
          type: string
          description: The ID of the invitation sent to the member account.
        InvitedAt:
          type: string
          format: date-time
          description: The timestamp of when the invitation was sent.
        MemberStatus:
          type: string
          description: The current status of the association between the member and administrator accounts.
    DisassociateFromMasterAccountRequest:
      type: object
      properties: {}
    InvalidAccessException:
      type: object
      properties:
        Message:
          type: string
        Code:
          type: string
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: securityhub
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/securityhub/service/2018-10-26/securityhub-2018-10-26.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)