AWS Security Hub Security Hub Organization API
The Security Hub Organization API from AWS Security Hub — 4 operation(s) for security hub organization.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/aws-security-hub:aws-security-hub-organization-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: AWS SecurityHub Organization API
version: '2018-10-26'
description: Generated from AWS's published Smithy model for AWS SecurityHub. 5 operation(s).
contact:
name: Amazon Web Services
url: https://aws.amazon.com/contact-us/
license:
name: Apache 2.0
identifier: Apache-2.0
url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://securityhub.{region}.amazonaws.com
variables:
region:
default: us-east-1
security:
- sigv4: []
tags:
- name: Organization
paths:
/organization/configuration:
get:
operationId: DescribeOrganizationConfiguration
summary: Describe Organization Configuration
description: Returns information about the way your organization is configured in Security Hub CSPM. Only the Security Hub CSPM administrator account can invoke this operation.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/DescribeOrganizationConfigurationResponse'
example:
AutoEnable: false
MemberAccountLimitReached: false
AutoEnableStandards: NONE
OrganizationConfiguration:
ConfigurationType: CENTRAL
Status: ENABLED
'500':
description: InternalException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalException'
'401':
description: InvalidAccessException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidAccessException'
'400':
description: InvalidInputException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidInputException'
'429':
description: LimitExceededException
content:
application/json:
schema:
$ref: '#/components/schemas/LimitExceededException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/DescribeOrganizationConfigurationRequest'
tags:
- Organization
post:
operationId: UpdateOrganizationConfiguration
summary: Update Organization Configuration
description: Updates the configuration of your organization in Security Hub CSPM. Only the Security Hub CSPM administrator account can invoke this operation.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateOrganizationConfigurationResponse'
'403':
description: AccessDeniedException
content:
application/json:
schema:
$ref: '#/components/schemas/AccessDeniedException'
'500':
description: InternalException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalException'
'401':
description: InvalidAccessException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidAccessException'
'400':
description: InvalidInputException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidInputException'
'429':
description: LimitExceededException
content:
application/json:
schema:
$ref: '#/components/schemas/LimitExceededException'
'409':
description: ResourceConflictException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceConflictException'
'404':
description: ResourceNotFoundException
content:
application/json:
schema:
$ref: '#/components/schemas/ResourceNotFoundException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateOrganizationConfigurationRequest'
example:
AutoEnable: false
AutoEnableStandards: NONE
OrganizationConfiguration:
ConfigurationType: CENTRAL
tags:
- Organization
/organization/admin/disable:
post:
operationId: DisableOrganizationAdminAccount
summary: Disable Organization Admin Account
description: Disables a Security Hub CSPM administrator account. Can only be called by the organization management account.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/DisableOrganizationAdminAccountResponse'
'403':
description: AccessDeniedException
content:
application/json:
schema:
$ref: '#/components/schemas/AccessDeniedException'
'500':
description: InternalException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalException'
'401':
description: InvalidAccessException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidAccessException'
'400':
description: InvalidInputException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidInputException'
'429':
description: LimitExceededException
content:
application/json:
schema:
$ref: '#/components/schemas/LimitExceededException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/DisableOrganizationAdminAccountRequest'
example:
AdminAccountId: '123456789012'
tags:
- Organization
/organization/admin/enable:
post:
operationId: EnableOrganizationAdminAccount
summary: Enable Organization Admin Account
description: Designates the Security Hub CSPM administrator account for an organization. Can only be called by the organization management account.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/EnableOrganizationAdminAccountResponse'
'403':
description: AccessDeniedException
content:
application/json:
schema:
$ref: '#/components/schemas/AccessDeniedException'
'500':
description: InternalException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalException'
'401':
description: InvalidAccessException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidAccessException'
'400':
description: InvalidInputException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidInputException'
'429':
description: LimitExceededException
content:
application/json:
schema:
$ref: '#/components/schemas/LimitExceededException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/EnableOrganizationAdminAccountRequest'
example:
AdminAccountId: '123456789012'
tags:
- Organization
/organization/admin:
get:
operationId: ListOrganizationAdminAccounts
summary: List Organization Admin Accounts
description: Lists the Security Hub CSPM administrator accounts. Can only be called by the organization management account.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/ListOrganizationAdminAccountsResponse'
example:
AdminAccounts:
- AccountId: '777788889999'
- Status: ENABLED
'500':
description: InternalException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalException'
'401':
description: InvalidAccessException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidAccessException'
'400':
description: InvalidInputException
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidInputException'
'429':
description: LimitExceededException
content:
application/json:
schema:
$ref: '#/components/schemas/LimitExceededException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ListOrganizationAdminAccountsRequest'
tags:
- Organization
components:
schemas:
DisableOrganizationAdminAccountResponse:
type: object
properties: {}
InvalidInputException:
type: object
properties:
Message:
type: string
Code:
type: string
DescribeOrganizationConfigurationRequest:
type: object
properties: {}
AdminAccount:
type: object
properties:
AccountId:
type: string
description: The Amazon Web Services account identifier of the Security Hub CSPM administrator account.
Status:
type: string
enum:
- ENABLED
- DISABLE_IN_PROGRESS
description: The current status of the Security Hub CSPM administrator account. Indicates whether the account is currently enabled as a Security Hub CSPM administrator.
DisableOrganizationAdminAccountRequest:
type: object
properties:
AdminAccountId:
type: string
description: The Amazon Web Services account identifier of the Security Hub CSPM administrator account.
Feature:
type: string
enum:
- SecurityHub
- SecurityHubV2
description: The feature for which the delegated admin account is disabled. Defaults to Security Hub CSPM if not specified.
required:
- AdminAccountId
InvalidAccessException:
type: object
properties:
Message:
type: string
Code:
type: string
EnableOrganizationAdminAccountResponse:
type: object
properties:
AdminAccountId:
type: string
description: The Amazon Web Services account identifier of the account to designate as the Security Hub CSPM administrator account.
Feature:
type: string
enum:
- SecurityHub
- SecurityHubV2
description: The feature where the delegated administrator is enabled. The default is Security Hub CSPM CSPM if no delegated administrator is specified in the request.
EnableOrganizationAdminAccountRequest:
type: object
properties:
AdminAccountId:
type: string
description: The Amazon Web Services account identifier of the account to designate as the Security Hub CSPM administrator account.
Feature:
type: string
enum:
- SecurityHub
- SecurityHubV2
description: The feature for which the delegated admin account is enabled. Defaults to Security Hub CSPM if not specified.
required:
- AdminAccountId
ResourceConflictException:
type: object
properties:
Message:
type: string
Code:
type: string
LimitExceededException:
type: object
properties:
Message:
type: string
Code:
type: string
DescribeOrganizationConfigurationResponse:
type: object
properties:
AutoEnable:
type: boolean
description: Whether to automatically enable Security Hub CSPM in new member accounts when they join the organization. If set to true, then Security Hub CSPM is automatically enabled in new accounts. If set to false, then Security Hub CSPM isn't enabled in new accounts automatically. The default value is false. If the ConfigurationType of your organization is set to CENTRAL, then this field is set to false and can't be changed in the home Region and linked Regions. However, in that case, the delegated administrator can create a configuration policy in which Security Hub CSPM is enabled and associate the po
MemberAccountLimitReached:
type: boolean
description: Whether the maximum number of allowed member accounts are already associated with the Security Hub CSPM administrator account.
AutoEnableStandards:
type: string
enum:
- NONE
- DEFAULT
description: Whether to automatically enable Security Hub CSPM default standards in new member accounts when they join the organization. If equal to DEFAULT, then Security Hub CSPM default standards are automatically enabled for new member accounts. If equal to NONE, then default standards are not automatically enabled for new member accounts. The default value of this parameter is equal to DEFAULT. If the ConfigurationType of your organization is set to CENTRAL, then this field is set to NONE and can't be changed in the home Region and linked Regions. However, in that case, the delegated administrator can
OrganizationConfiguration:
$ref: '#/components/schemas/OrganizationConfiguration'
OrganizationConfiguration:
type: object
properties:
ConfigurationType:
type: string
enum:
- CENTRAL
- LOCAL
description: Indicates whether the organization uses local or central configuration. If you use local configuration, the Security Hub CSPM delegated administrator can set AutoEnable to true and AutoEnableStandards to DEFAULT. This automatically enables Security Hub CSPM and default security standards in new organization accounts. These new account settings must be set separately in each Amazon Web Services Region, and settings may be different in each Region. If you use central configuration, the delegated administrator can create configuration policies. Configuration policies can be used to configure Secu
Status:
type: string
enum:
- PENDING
- ENABLED
- FAILED
description: Describes whether central configuration could be enabled as the ConfigurationType for the organization. If your ConfigurationType is local configuration, then the value of Status is always ENABLED.
StatusMessage:
type: string
description: Provides an explanation if the value of Status is equal to FAILED when ConfigurationType is equal to CENTRAL.
UpdateOrganizationConfigurationResponse:
type: object
properties: {}
ListOrganizationAdminAccountsResponse:
type: object
properties:
AdminAccounts:
type: array
items:
$ref: '#/components/schemas/AdminAccount'
description: The list of Security Hub CSPM administrator accounts.
NextToken:
type: string
description: The pagination token to use to request the next page of results.
Feature:
type: string
enum:
- SecurityHub
- SecurityHubV2
description: The feature where the delegated administrator account is listed. Defaults to Security Hub CSPM CSPM if not specified.
ResourceNotFoundException:
type: object
properties:
Message:
type: string
Code:
type: string
UpdateOrganizationConfigurationRequest:
type: object
properties:
AutoEnable:
type: boolean
description: Whether to automatically enable Security Hub CSPM in new member accounts when they join the organization. If set to true, then Security Hub CSPM is automatically enabled in new accounts. If set to false, then Security Hub CSPM isn't enabled in new accounts automatically. The default value is false. If the ConfigurationType of your organization is set to CENTRAL, then this field is set to false and can't be changed in the home Region and linked Regions. However, in that case, the delegated administrator can create a configuration policy in which Security Hub CSPM is enabled and associate the po
AutoEnableStandards:
type: string
enum:
- NONE
- DEFAULT
description: Whether to automatically enable Security Hub CSPM default standards in new member accounts when they join the organization. The default value of this parameter is equal to DEFAULT. If equal to DEFAULT, then Security Hub CSPM default standards are automatically enabled for new member accounts. If equal to NONE, then default standards are not automatically enabled for new member accounts. If the ConfigurationType of your organization is set to CENTRAL, then this field is set to NONE and can't be changed in the home Region and linked Regions. However, in that case, the delegated administrator can
OrganizationConfiguration:
$ref: '#/components/schemas/OrganizationConfiguration'
required:
- AutoEnable
InternalException:
type: object
properties:
Message:
type: string
Code:
type: string
ListOrganizationAdminAccountsRequest:
type: object
properties:
MaxResults:
type: integer
description: The maximum number of items to return in the response.
NextToken:
type: string
description: The token that is required for pagination. On your first call to the ListOrganizationAdminAccounts operation, set the value of this parameter to NULL. For subsequent calls to the operation, to continue listing data, set the value of this parameter to the value returned from the previous response.
Feature:
type: string
enum:
- SecurityHub
- SecurityHubV2
description: The feature where the delegated administrator account is listed. Defaults to Security Hub CSPM if not specified.
AccessDeniedException:
type: object
properties:
Message:
type: string
Code:
type: string
securitySchemes:
sigv4:
type: apiKey
in: header
name: Authorization
description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
x-aws-sigv4:
signingName: securityhub
x-provenance:
method: harvested
publisher: Amazon Web Services
source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/securityhub/service/2018-10-26/securityhub-2018-10-26.json
note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)