Cloudera

Cloudera Iam API

The Iam API from Cloudera — 79 operation(s) for iam.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 79

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /iam/getUser Look up a CDP user's details · Gets information on a user #
Ask an LLM
“How can I see the details of one user in my CDP account?”
“Which CDP user does my current access key belong to?”
Tell an agent
Show me the CDP user profile for {userId}.
Tell me which CDP user my access key is authenticated as.
POST /iam/listUsers List users in the CDP account · Lists users #
Ask an LLM
“Can I get a list of every human user in my Cloudera CDP account?”
“Is the CDP user listing paginated with a page size?”
Tell an agent
List all users in my CDP account.
List the CDP users {userIds}, {pageSize} per page.
POST /iam/createUser Create a CDP user · Creates a user in CDP #
Ask an LLM
“How do I add a new person as a user in CDP with their email and identity provider ID?”
“Can I put a new CDP user into groups at the moment I create them?”
Tell an agent
Create a CDP user with email {email} and identity provider user ID {identityProviderUserId}.
Create CDP user {firstName} {lastName} ({email}, IdP ID {identityProviderUserId}) and add them to groups {groups}.
POST /iam/updateUser Activate or deactivate a CDP user · Updates a user #
Ask an LLM
“Can I deactivate a CDP user without deleting them?”
“What happens if I send a user update with no fields changed?”
Tell an agent
Deactivate CDP user {user} by setting active to {active}.
Reactivate the CDP user {user}.
POST /iam/deleteUser Delete a CDP user and their access · Deletes a user and all associated resources #
Ask an LLM
“What gets removed when I delete a human user from CDP?”
“Does deleting a CDP user also remove their access keys and group memberships?”
Tell an agent destructive · confirm first
Delete CDP user {userId} along with their access keys and role assignments.
Permanently remove the person {userId} from my CDP account.
POST /iam/createUserAccessKey Create an API access key for a user · Creates a new access key for a user #
Ask an LLM
“How do I generate a CDP API access key for a human user?”
“Can I choose the key type when creating an access key for a user?”
Tell an agent
Create a new API access key for user {user}.
Generate a {type} access key for CDP user {user}.
POST /iam/createMachineUserAccessKey Create an access key for a machine user · Creates a new access key for a machine user #
Ask an LLM
“How do I give a CDP machine user an API key for automation?”
“Which key types can I pick when creating a machine user's access key?”
Tell an agent
Create an access key for machine user {machineUserName}.
Generate a {type} access key for the service account {machineUserName}.
POST /iam/deleteAccessKey Delete an API access key · Deletes an access key #
Ask an LLM
“How do I permanently delete a CDP access key that leaked?”
“Is deleting an access key different from just disabling it?”
Tell an agent destructive · confirm first
Delete access key {accessKeyId}.
Permanently remove the CDP API key {accessKeyId}.
POST /iam/updateAccessKey Enable or disable an access key · Updates an access key #
Ask an LLM
“Can I temporarily disable a CDP access key instead of deleting it?”
“How do I turn an inactive access key back on?”
Tell an agent
Set the status of access key {accessKeyId} to {status}.
Disable access key {accessKeyId} for now.
POST /iam/getAccessKey Look up an access key's details · Gets information on an access key #
Ask an LLM
“Which actor owns a given CDP access key and is it active?”
“Can I see details of the access key I'm calling the API with?”
Tell an agent
Show details for access key {accessKeyId}.
Describe the access key I'm currently using.
POST /iam/listAccessKeys List access keys in the account · Lists access keys #
Ask an LLM
“What API access keys exist across my CDP account?”
“Can I page through access keys a few at a time?”
Tell an agent
List all CDP access keys.
List access keys {accessKeyIds}.
POST /iam/listRoles List the account-level roles available · Lists all the available roles #
Ask an LLM
“What account-wide roles can I grant in CDP?”
“Which policies do CDP roles carry?”
Tell an agent
List every account role available in CDP.
Show the roles named {roleNames}.
POST /iam/listResourceRoles List available resource roles · Lists all the available resource roles #
Ask an LLM
“Which resource roles exist for granting rights over specific CDP resources?”
“Can I look up a resource role's CRN by name?”
Tell an agent
List all resource roles available in CDP.
Show the resource roles {resourceRoleNames}.
POST /iam/setAccountMessages Set the account's contact-your-admin message · Set messages for an account #
Ask an LLM
“Can I customize the 'contact your administrator' message users see in CDP?”
“Where do I set the help text shown to users who lack access?”
Tell an agent
Set the contact-your-administrator message to {contactYourAdministratorMessage}.
Update the account message users see when they need admin help to {contactYourAdministratorMessage}.
POST /iam/getAccountMessages Get the account's custom messages · Get account messages #
Ask an LLM
“What admin contact message is currently configured for my CDP account?”
“Can I read back the custom account messages users see?”
Tell an agent
Show the current account messages.
Get the contact-your-administrator text set on my CDP account.
POST /iam/assignUserRole Grant an account role to a user · Assign a role to a user #
Ask an LLM
“How do I give a human user an account-level role like PowerUser?”
“What happens if the user already has that role?”
Tell an agent
Assign role {role} to user {user}.
Grant {user} the account role {role}.
POST /iam/unassignUserRole Remove an account role from a user · Unassign a role from a user #
Ask an LLM
“How can I take an account role away from a human user?”
“Will unassigning fail if the user doesn't have the role?”
Tell an agent destructive · confirm first
Unassign role {role} from user {user}.
Revoke the account role {role} held by {user}.
POST /iam/assignUserResourceRole Grant a user a role on a specific resource · Assign a resource role to a user #
Ask an LLM
“How do I give a user rights over a single environment rather than the whole account?”
“What CRNs do I need to grant a resource role to a person?”
Tell an agent
Assign resource role {resourceRoleCrn} on {resourceCrn} to user {user}.
Give user {user} the {resourceRoleCrn} resource role over resource {resourceCrn}.
POST /iam/unassignUserResourceRole Remove a user's role on a specific resource · Unassign a resource role from a user #
Ask an LLM
“How do I revoke a person's access to one specific CDP resource?”
“Does removing a user's resource role fail if it wasn't assigned?”
Tell an agent destructive · confirm first
Unassign resource role {resourceRoleCrn} on {resourceCrn} from user {user}.
Revoke user {user}'s {resourceRoleCrn} rights over {resourceCrn}.
POST /iam/listUserAssignedRoles List a user's account roles · Lists the user's assigned roles #
Ask an LLM
“What account roles does a particular human user hold?”
“Which account roles do I have myself?”
Tell an agent
List the account roles assigned to user {user}.
Show my own assigned account roles.
POST /iam/listUserAssignedResourceRoles List a user's resource role assignments · Lists a user's assigned resource roles #
Ask an LLM
“Which resources does a user have resource roles on?”
“Can I audit a person's per-resource permissions?”
Tell an agent
List the resource roles assigned to user {user}.
Show my own resource role assignments.
POST /iam/assignMachineUserRole Grant an account role to a machine user · Assign a role to a machine user #
Ask an LLM
“How do I give a service account (machine user) an account-level role?”
“Will it error if the machine user already has the role?”
Tell an agent
Assign role {role} to machine user {machineUserName}.
Grant the service account {machineUserName} the account role {role}.
POST /iam/unassignMachineUserRole Remove an account role from a machine user · Unassign a role from a machine user #
Ask an LLM
“Can I strip an account role from a machine user?”
“What if the machine user doesn't actually hold the role I'm removing?”
Tell an agent destructive · confirm first
Unassign role {role} from machine user {machineUserName}.
Revoke account role {role} from the service account {machineUserName}.
POST /iam/assignMachineUserResourceRole Grant a machine user a role on a resource · Assign a resource role to a machine user #
Ask an LLM
“How do I scope a machine user's permissions to a single CDP resource?”
“Which CRNs are required to give a service account a resource role?”
Tell an agent
Grant machine account {machineUserName} resource-scoped role {resourceRoleCrn} over {resourceCrn}.
Let service account {machineUserName} act as {resourceRoleCrn} over {resourceCrn}.
POST /iam/unassignMachineUserResourceRole Remove a machine user's role on a resource · Unassign a resource role from a machine user #
Ask an LLM
“How do I revoke a machine user's rights on one specific resource?”
“Does removing a service account's resource role fail when it isn't assigned?”
Tell an agent destructive · confirm first
Strip resource-scoped role {resourceRoleCrn} on {resourceCrn} from machine account {machineUserName}.
Revoke service account {machineUserName}'s {resourceRoleCrn} rights on {resourceCrn}.
POST /iam/listMachineUserAssignedRoles List a machine user's account roles · Lists the machine user's assigned roles #
Ask an LLM
“What account roles has a given machine user been granted?”
“Can I audit the account-level roles of a service account?”
Tell an agent
Enumerate the account-wide roles carried by machine account {machineUserName}.
Show which account roles the service account {machineUserName} holds.
POST /iam/listMachineUserAssignedResourceRoles List a machine user's resource roles · Lists a machine user's assigned resource roles #
Ask an LLM
“Which resources does a machine user hold resource roles on?”
“Can I review a service account's per-resource permissions?”
Tell an agent
Audit resource-scoped grants for machine account {machineUserName}.
Show the per-resource grants for service account {machineUserName}.
POST /iam/listResourceAssignees List who has roles on a resource · List the resource assignees and their respective resource roles for the resource #
Ask an LLM
“Who has access to a particular CDP environment or resource, and with which role?”
“Can I list every assignee of a resource along with their resource roles?”
Tell an agent
List everyone assigned resource roles on {resourceCrn}.
Show the assignees and their roles for resource {resourceCrn}, {pageSize} at a time.
POST /iam/createMachineUser Create a machine user for API access · Create a machine user #
Ask an LLM
“How do I create a service account in CDP for automation scripts?”
“Can a machine user log in to the CDP console?”
Tell an agent
Create a machine user named {machineUserName}.
Set up a new CDP service account called {machineUserName} for my pipelines.
POST /iam/listMachineUsers List machine users in the account · Lists machine users #
Ask an LLM
“What service accounts (machine users) exist in my CDP account?”
“Can I look up specific machine users by name?”
Tell an agent
List all machine users in my account.
Show the machine users {machineUserNames}.
POST /iam/deleteMachineUser Delete a machine user · Delete a machine user #
Ask an LLM
“What gets cleaned up when I delete a CDP machine user?”
“Does deleting a service account remove its access keys and group memberships?”
Tell an agent destructive · confirm first
Delete machine user {machineUserName}.
Remove the service account {machineUserName} and all its access keys.
POST /iam/createSamlProvider Register a SAML identity provider · Creates a SAML provider in CDP #
Ask an LLM
“How do I connect my SAML identity provider to CDP for single sign-on?”
“Can I enable SCIM provisioning when adding a SAML provider?”
Tell an agent
Create SAML provider {samlProviderName} with metadata {samlMetadataDocument}.
Add SAML provider {samlProviderName} with SCIM set to {enableScim} and group sync on login {syncGroupsOnLogin}.
POST /iam/deleteSamlProvider Delete a SAML identity provider · Deletes a SAML provider in CDP account #
Ask an LLM
“How do I remove a SAML identity provider from my CDP account?”
“Can I disconnect an old SSO provider I no longer use?”
Tell an agent destructive · confirm first
Delete SAML provider {samlProviderName}.
Remove the {samlProviderName} SSO connection from CDP.
POST /iam/listSamlProviders List SAML identity providers · Lists SAML providers in CDP account #
Ask an LLM
“Which SAML identity providers are configured in my CDP account?”
“Can I page through SAML providers by name?”
Tell an agent
List all SAML providers in my account.
List SAML providers named {samlProviderNames}.
POST /iam/describeSamlProvider Show one SAML provider's configuration · Describes one SAML provider #
Ask an LLM
“What settings does a specific SAML provider have, like SCIM or group sync?”
“Can I view the full configuration of one SSO provider?”
Tell an agent
Describe SAML provider {samlProviderName}.
Show the configuration of the {samlProviderName} SSO connection.
POST /iam/updateSamlProvider Update a SAML provider's settings · Updates a SAML provider in CDP #
Ask an LLM
“How do I upload new SAML metadata for an existing identity provider?”
“Can I switch on SCIM for a SAML provider that's already set up?”
Tell an agent
Update SAML provider {samlProviderName} with new metadata {samlMetadataDocument}.
Turn workload usernames from email to {generateWorkloadUsernameByEmail} on existing SAML provider {samlProviderName}.
POST /iam/enableClouderaSSOLogin Enable Cloudera SSO login for the account · Enables interactive login using Cloudera SSO for this account #
Ask an LLM
“How do I allow all users to log in with Cloudera SSO?”
“Is turning on Cloudera SSO safe if it's already enabled?”
Tell an agent
Enable Cloudera SSO interactive login for my account.
Turn Cloudera SSO login back on for everyone.
POST /iam/disableClouderaSSOLogin Disable Cloudera SSO login for non-admins · Disables interactive login using Cloudera SSO for this account #
Ask an LLM
“Can I force users to log in through my own identity provider instead of Cloudera SSO?”
“Who can still use Cloudera SSO after it's disabled?”
Tell an agent
Disable Cloudera SSO login for my account.
Restrict Cloudera SSO so only account administrators can use it.
POST /iam/getAccount Get CDP account information · Retrieves information about the CDP account #
Ask an LLM
“What account-level settings does my CDP tenant have?”
“Can I retrieve information about my CDP account itself?”
Tell an agent
Show my CDP account information.
Get the details of the current CDP account.
POST /iam/createGroup Create a user group · Create a group #
Ask an LLM
“How do I create a group in CDP to manage roles for many users at once?”
“Can a group's membership sync from the identity provider on login?”
Tell an agent
Create a group called {groupName}.
Create group {groupName} with sync-membership-on-login set to {syncMembershipOnUserLogin}.
POST /iam/deleteGroup Delete a user group · Delete a group #
Ask an LLM
“How do I delete a CDP group I no longer need?”
“Can I remove an obsolete group from my account?”
Tell an agent destructive · confirm first
Delete group {groupName}.
Remove the {groupName} group from CDP.
POST /iam/listGroups List groups in the account · Lists groups #
Ask an LLM
“What groups exist in my CDP account?”
“Can I look up a few specific groups by name?”
Tell an agent
List all groups in my CDP account.
Show the groups {groupNames}.
POST /iam/updateGroup Change a group's membership sync setting · Update a group #
Ask an LLM
“Can I change whether an existing group syncs its members when users log in?”
“Is there a way to edit a group's settings after creating it?”
Tell an agent
Set sync-membership-on-login to {syncMembershipOnUserLogin} for existing group {groupName}.
Update group {groupName} so login no longer syncs membership.
POST /iam/addUserToGroup Add a user to a group · Add a user to a group #
Ask an LLM
“How do I put a human user into a CDP group?”
“Does adding someone to a group give them the group's roles?”
Tell an agent
Add user {userId} to group {groupName}.
Make {userId} a member of the {groupName} group.
POST /iam/addMachineUserToGroup Add a machine user to a group · Add a machine user to group #
Ask an LLM
“Can a service account be a member of a CDP group?”
“How do I give a machine user a group's permissions?”
Tell an agent
Add machine user {machineUserName} to group {groupName}.
Put the service account {machineUserName} into {groupName}.
POST /iam/removeUserFromGroup Remove a user from a group · Remove a user from a group #
Ask an LLM
“How do I take a person out of a CDP group?”
“Will removing a user from a group drop the roles they got through it?”
Tell an agent destructive · confirm first
Remove user {userId} from group {groupName}.
Take {userId} out of the {groupName} group.
POST /iam/removeMachineUserFromGroup Remove a machine user from a group · Remove a machine user from a group #
Ask an LLM
“Can I pull a service account out of a group?”
“How do I stop a machine user inheriting a group's roles?”
Tell an agent destructive · confirm first
Remove machine user {machineUserName} from group {groupName}.
Take the service account {machineUserName} out of {groupName}.
POST /iam/listGroupMembers List the members of a group · List the members of a group #
Ask an LLM
“Who belongs to a given CDP group?”
“Does the group member list include machine users too?”
Tell an agent
List the members of group {groupName}.
Show everyone in {groupName}, {pageSize} per page.
POST /iam/listGroupsForUser List the groups a user belongs to · List the groups that the user belongs to #
Ask an LLM
“Which groups is a particular person a member of?”
“Can I see all group memberships for one human user?”
Tell an agent
List the groups user {userId} belongs to.
Show group memberships for {userId}.
POST /iam/listGroupsForMachineUser List the groups a machine user belongs to · List the groups that the machine user belongs to #
Ask an LLM
“Which groups has a service account been added to?”
“Can I check a machine user's group memberships?”
Tell an agent
Find every group that machine account {machineUserName} is in.
Show group memberships for the service account {machineUserName}.
POST /iam/assignGroupRole Grant an account role to a group · Assign a role to a group #
Ask an LLM
“How do I give every member of a group the same account role?”
“Will assigning fail if the group already has that role?”
Tell an agent
Assign role {role} to group {groupName}.
Grant all members of {groupName} the account role {role}.
POST /iam/unassignGroupRole Remove an account role from a group · Unassign a role from a group #
Ask an LLM
“Can I revoke an account role from an entire group at once?”
“What if the group doesn't currently have the role?”
Tell an agent destructive · confirm first
Unassign role {role} from group {groupName}.
Revoke the {role} account role from everyone in {groupName}.
POST /iam/assignGroupResourceRole Grant a group a role on a resource · Assign a resource role to a group #
Ask an LLM
“How do I give a whole group access to one specific CDP environment?”
“Which CRNs do I need to assign a group a resource role?”
Tell an agent
Assign resource role {resourceRoleCrn} on {resourceCrn} to group {groupName}.
Let group {groupName} act as {resourceRoleCrn} over resource {resourceCrn}.
POST /iam/unassignGroupResourceRole Remove a group's role on a resource · Unassign a resource role from a group #
Ask an LLM
“How can I revoke a group's rights on a single resource?”
“Does removing a group's resource role fail if it isn't assigned?”
Tell an agent destructive · confirm first
Unassign resource role {resourceRoleCrn} on {resourceCrn} from group {groupName}.
Revoke group {groupName}'s {resourceRoleCrn} rights on {resourceCrn}.
POST /iam/listGroupAssignedRoles List a group's account roles · Lists the group's assigned roles #
Ask an LLM
“What account roles are attached to a particular group?”
“Can I audit the account-level roles a group grants its members?”
Tell an agent
List the account roles assigned to group {groupName}.
Show which account roles {groupName} holds.
POST /iam/listGroupAssignedResourceRoles List a group's resource role assignments · Lists a group's assigned resource roles #
Ask an LLM
“Which resources does a group have resource roles on?”
“Can I review a group's per-resource permissions?”
Tell an agent
List the resource roles assigned to group {groupName}.
Show the per-resource grants held by group {groupName}.
POST /iam/setWorkloadPassword Set an actor's workload password · Set the workload password for an actor #
Ask an LLM
“How do I set the password I use to log in to workload clusters in my environments?”
“Does a workload password apply to environments I get access to later?”
Tell an agent
Set my workload password to {password}.
Set the workload password for actor {actorCrn} to {password}.
POST /iam/unsetWorkloadPasswordMinLifetime Clear an actor's workload password minimum lifetime · Removes workload password minimum lifetime date for an actor #
Ask an LLM
“Can I let a user change their workload password again before the minimum lifetime is up?”
“How do I remove the minimum lifetime date on someone's workload password?”
Tell an agent
Remove the workload password minimum lifetime for actor {actorCrn}.
Clear the min-lifetime lock on {actorCrn}'s workload password.
POST /iam/setWorkloadPasswordPolicy Set the account's workload password policy · Set the workload password policy for the account #
Ask an LLM
“Can I make workload passwords expire across my CDP account?”
“Does a new workload password policy affect passwords already set?”
Tell an agent
Set the global workload password policy to {globalPasswordPolicy}.
Apply workload password policy {machineUsersPasswordPolicy} to machine users.
POST /iam/unsetWorkloadPasswordPolicy Remove the account's workload password policy · Unset workload password policy for the account #
Ask an LLM
“How do I go back to workload passwords that never expire?”
“Can I clear only the machine-user password policy and keep the global one?”
Tell an agent
Unset the global workload password policy.
Remove the machine users workload password policy by setting unset flag {unsetMachineUsersPasswordPolicy}.
POST /iam/addSshPublicKey Add an SSH public key for cluster access · Adds an SSH public key for an actor #
Ask an LLM
“How do I upload my SSH public key so I can SSH into workload clusters?”
“Can I add an SSH key on behalf of another actor?”
Tell an agent
Add SSH public key {publicKey} to my account.
Add SSH key {publicKey} for actor {actorCrn} described as {description}.
POST /iam/listSshPublicKeys List an actor's SSH public keys · Lists SSH public keys for an actor #
Ask an LLM
“Which SSH public keys are registered for me in CDP?”
“Can I see the SSH keys another user has uploaded?”
Tell an agent
List my SSH public keys.
List the SSH public keys for actor {actorCrn}.
POST /iam/describeSshPublicKey Describe one SSH public key · Describes an SSH public key for an actor #
Ask an LLM
“Can I look up an SSH key by its fingerprint?”
“What details are stored for a single SSH public key?”
Tell an agent
Describe the SSH key with fingerprint or CRN {crnOrFingerprint}.
Show SSH key {crnOrFingerprint} belonging to {actorCrn}.
POST /iam/deleteSshPublicKey Delete an SSH public key · Deletes an SSH public key for an actor #
Ask an LLM
“How do I remove an old SSH key so it can't reach workload clusters anymore?”
“Can I delete an SSH key by fingerprint?”
Tell an agent destructive · confirm first
Delete SSH key {crnOrFingerprint}.
Remove SSH public key {crnOrFingerprint} from actor {actorCrn}.
POST /iam/updateLdapProvider Update an LDAP identity provider · UpdateLdapProvider #
Ask an LLM
“How do I change the URL or search filters of an existing LDAP connection?”
“Can I rotate the bind password on an LDAP provider I already configured?”
Tell an agent
Update existing LDAP provider {ldapProviderName} to use URL {url}.
Change the bind password on LDAP provider {ldapProviderName} to {bindPassword}.
POST /iam/createLdapProvider Create an LDAP identity provider · CreateLdapProvider #
Ask an LLM
“How do I connect my LDAP directory to CDP for user authentication?”
“What search bases and filters are required to add a new LDAP provider?”
Tell an agent
Create a new LDAP provider {ldapProviderName} at {url} with user search base {userSearchBase} and group search base {groupSearchBase}.
Add LDAP provider {ldapProviderName} mapping usernames from attribute {usernameMappingAttribute}.
POST /iam/getDefaultIdentityProvider Get the default identity provider · Retrieves the CRN of the default identity provider #
Ask an LLM
“Which identity provider does CDP use by default when it starts a login?”
“What is the CRN of my account's default IdP?”
Tell an agent
Show the default identity provider for my account.
Get the CRN of the IdP used for CDP-initiated logins.
POST /iam/setDefaultIdentityProvider Set the default identity provider · Sets the default identity provider #
Ask an LLM
“Can I change which identity provider CDP sends users to at login?”
“How do I make my new SAML provider the default for CDP-initiated logins?”
Tell an agent
Make {nameOrCrn} the default identity provider.
Switch CDP-initiated logins to use identity provider {nameOrCrn}.
POST /iam/generateWorkloadAuthToken Generate a token for workload APIs · Generates an authentication token for workload APIs #
Ask an LLM
“How do I get an auth token to call a workload API like Data Engineering jobs?”
“Can I leave group memberships out of a workload auth token?”
Tell an agent
Generate a workload auth token for {workloadName}.
Generate a {workloadName} workload token for environment {environmentCrn}.
POST /iam/createScimAccessToken Create a SCIM access token · Creates a SCIM access token for a SCIM enabled identity provider #
Ask an LLM
“How do I create a token so my identity provider can push users to CDP over SCIM?”
“Can I set how many days a SCIM access token stays valid?”
Tell an agent
Create a SCIM access token for identity provider {identityProviderNameOrCrn} valid for {accessTokenLifetimeDays} days.
Issue a new SCIM provisioning token for {identityProviderNameOrCrn} lasting {accessTokenLifetimeDays} days.
POST /iam/listScimAccessTokens List SCIM access tokens for an identity provider · Lists SCIM access tokens for a SCIM enabled identity provider #
Ask an LLM
“Which SCIM tokens are active for my identity provider?”
“Is SCIM token listing available on Cloudera for Government?”
Tell an agent
List SCIM access tokens for identity provider {identityProviderNameOrCrn}.
Show all SCIM provisioning tokens issued for {identityProviderNameOrCrn}.
POST /iam/deleteScimAccessToken Delete a SCIM access token · Deletes a SCIM access token #
Ask an LLM
“How do I revoke a SCIM token that my IdP no longer uses?”
“Can I delete a SCIM access token by its ID?”
Tell an agent destructive · confirm first
Delete SCIM access token {accessTokenIdOrCrn}.
Revoke the SCIM provisioning token {accessTokenIdOrCrn}.
POST /iam/unlockUserInControlPlane Unlock a locked-out user · Unlocks user in the CDP control plane #
Ask an LLM
“How do I unlock a human user who got locked out of the CDP control plane?”
“Is unlocking a user who isn't locked harmless?”
Tell an agent
Unlock user {user} in the control plane.
Restore control plane access for locked-out user {user}.
POST /iam/unlockMachineUserInControlPlane Unlock a locked-out machine user · Unlocks machine user in the CDP control plane #
Ask an LLM
“Can I unlock a service account that's locked in the CDP control plane?”
“Which deployments support unlocking machine users?”
Tell an agent
Clear the control plane lockout on machine account {machineUser}.
Restore control plane access for the service account {machineUser}.
POST /iam/setSamlAuthnRequestSigningKey Set the SAML AuthnRequest signing key · Sets the SAML AuthnRequest signing key and verification certificate #
Ask an LLM
“How do I make CDP sign SAML authentication requests to my IdP?”
“Can I stage the next verification certificate for a signing key rotation?”
Tell an agent
Set the AuthnRequest signing key for SAML provider {samlProvider} to {authnRequestSigningKey}.
Add next AuthnRequest verification certificate {nextAuthnRequestVerificationCertificate} to SAML provider {samlProvider}.
POST /iam/migrateUsersToIdentityProvider Move users to a different identity provider · Migrates all users from an identity provider connector to a different identity… #
Ask an LLM
“How do I migrate all users from LDAP authentication to SAML?”
“Do user IDs need to match in both identity providers for a migration?”
Tell an agent
Migrate all users from identity provider {originalProviderName} to {newProviderName}.
Reassociate every user on {originalProviderName} with the {newProviderName} connector.
POST /iam/setSamlResponseDecryptionKey Set the SAML response encryption keys · Sets encryption certificate and decryption key for SAML response sent from… #
Ask an LLM
“Can my IdP encrypt SAML responses sent to CDP?”
“Does setting a SAML decryption key replace the one stored before?”
Tell an agent
Set SAML response encryption certificate {samlResponseEncryptionCertificate} for provider {samlProvider}.
Set the current SAML response decryption key on {samlProvider} to {currentSamlResponseDecryptionKey}.
POST /iam/enableUserWorkloadPasswordChangedNotifications Turn on workload password change emails · Enables sending user workload password changed email notifications for the… #
Ask an LLM
“Can users get an email whenever their workload password changes?”
“How do I enable password-changed notifications for the whole account?”
Tell an agent
Enable workload password changed email notifications.
Start emailing users when their workload password is changed.
POST /iam/disableUserWorkloadPasswordChangedNotifications Turn off workload password change emails · Disables sending user workload password changed email notifications for the… #
Ask an LLM
“How do I stop CDP emailing users about workload password changes?”
“Can I silence password-changed notifications account-wide?”
Tell an agent
Disable workload password changed email notifications.
Stop sending users emails when their workload password changes.

Documentation

📖
Documentation
https://docs.cloudera.com/cdp-public-cloud/cloud/api/topics/mc-api-overview.html
📖
APIReference
https://cloudera.github.io/cdp-dev-docs/api-docs/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/cloudera/refs/heads/main/openapi/cloudera-iam-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/cloudera/refs/heads/main/json-schema/cloudera-update-ldap-provider-request-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/cloudera/refs/heads/main/json-schema/cloudera-create-ldap-provider-request-schema.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/cloudera:cloudera-iam-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

cloudera-iam-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  version: 0.9.163
  title: Cloudera Service Iam API
  license:
    name: Apache 2.0
  description: Cloudera CDP IAM is a web service that you can use to manage users and user permissions under your CDP account.
  termsOfService: https://www.cloudera.com/legal/commercial-terms-and-conditions.html
tags:


# --- truncated at 32 KB (179 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cloudera/refs/heads/main/openapi/cloudera-iam-api-openapi.yml