Exoscale role API
IAM roles lets you define logical sets of policies to grant to users and API keys.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/exoscale-role-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
version: 2.0.0
termsOfService: https://exoscale.com/terms
contact:
email: support@exoscale.com
name: Exoscale Support
url: https://portal.exoscale.com/tickets
title: Exoscale ai-api-key Role API
description: Infrastructure automation API, allowing programmatic access to all Exoscale products and services.
servers:
- url: https://api-{zone}.exoscale.com/v2
variables:
zone:
default: ch-gva-2
enum:
- ch-gva-2
- ch-dk-2
- de-fra-1
- de-muc-1
- at-vie-1
- at-vie-2
- bg-sof-1
- hr-zag-1
tags:
- description: IAM roles lets you define logical sets of policies to grant to users and API keys.
parent: iam
externalDocs:
description: Read more
url: https://community.exoscale.com/product/iam/operation/role-mgmt/
name: role
x-display-name: Role
x-weight: 820
x-icon: exo-iam
paths:
/iam-role/{target-role-id}/assume:
post:
tags:
- role
responses:
'200':
description: '200'
content:
application/json:
schema:
type: object
properties:
key:
type: string
name:
type: string
org-id:
type: string
role-id:
type: string
secret:
type: string
description: '[BETA] Request generation of key/secret that allow caller to assume target role'
parameters:
- in: path
required: true
name: target-role-id
schema:
type: string
format: uuid
summary: '[BETA] Request generation of key/secret that allow caller to assume target role'
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
ttl:
type: integer
format: int64
description: TTL in seconds for the generated access key (cannot exceed the max TTL defined in the targeted assume role)
exclusiveMinimum: 0
operationId: assume-iam-role
/iam-role/{id}:
put:
tags:
- role
responses:
'200':
description: '200'
content:
application/json:
schema:
$ref: '#/components/schemas/operation'
description: ''
parameters:
- in: path
required: true
name: id
schema:
type: string
format: uuid
summary: Update IAM Role
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
description:
type: string
maxLength: 255
minLength: 1
description: IAM Role description
permissions:
type: array
items:
type: string
enum:
- bypass-governance-retention
- reset-iam-organization-policy
uniqueItems: true
description: IAM Role permissions
labels:
$ref: '#/components/schemas/labels'
description: IAM Role labels
max-session-ttl:
type: integer
format: int64
description: Maximum TTL requester is allowed to ask for when assuming a role
exclusiveMinimum: 0
operationId: update-iam-role
get:
tags:
- role
responses:
'200':
description: '200'
content:
application/json:
schema:
$ref: '#/components/schemas/iam-role'
description: ''
parameters:
- in: path
required: true
name: id
schema:
type: string
format: uuid
summary: Retrieve IAM Role
operationId: get-iam-role
delete:
tags:
- role
responses:
'200':
description: '200'
content:
application/json:
schema:
$ref: '#/components/schemas/operation'
description: ''
parameters:
- in: path
required: true
name: id
schema:
type: string
format: uuid
summary: Delete IAM Role
operationId: delete-iam-role
/iam-role/{id}:assume-role-policy:
put:
tags:
- role
responses:
'200':
description: '200'
content:
application/json:
schema:
$ref: '#/components/schemas/operation'
description: ''
parameters:
- in: path
required: true
name: id
schema:
type: string
format: uuid
summary: Update IAM Assume role Policy
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/iam-policy'
operationId: update-iam-role-assume-policy
/iam-role/{id}:policy:
put:
tags:
- role
responses:
'200':
description: '200'
content:
application/json:
schema:
$ref: '#/components/schemas/operation'
description: ''
parameters:
- in: path
required: true
name: id
schema:
type: string
format: uuid
summary: Update IAM Role Policy
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/iam-policy'
operationId: update-iam-role-policy
/iam-role:
get:
tags:
- role
responses:
'200':
description: '200'
content:
application/json:
schema:
type: object
properties:
iam-roles:
type: array
items:
$ref: '#/components/schemas/iam-role'
description: ''
parameters: []
summary: List IAM Roles
operationId: list-iam-roles
post:
tags:
- role
responses:
'200':
description: '200'
content:
application/json:
schema:
$ref: '#/components/schemas/operation'
description: ''
parameters: []
summary: Create IAM Role
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
name:
type: string
maxLength: 191
minLength: 1
description: IAM Role name
description:
type: string
maxLength: 255
minLength: 1
description: IAM Role description
permissions:
type: array
items:
type: string
enum:
- bypass-governance-retention
- reset-iam-organization-policy
uniqueItems: true
description: IAM Role permissions
editable:
type: boolean
description: 'Sets if the IAM Role Policy is editable or not (default: true). This setting cannot be changed after creation'
labels:
$ref: '#/components/schemas/labels'
description: IAM Role labels
policy:
$ref: '#/components/schemas/iam-policy'
description: IAM Role policy
assume-role-policy:
$ref: '#/components/schemas/iam-policy'
description: IAM Assume role policy
max-session-ttl:
type: integer
format: int64
description: Maximum TTL requester is allowed to ask for when assuming a role
exclusiveMinimum: 0
required:
- name
operationId: create-iam-role
components:
schemas:
iam-role:
type: object
properties:
description:
type: string
maxLength: 255
minLength: 1
description: IAM Role description
labels:
$ref: '#/components/schemas/labels'
description: IAM Role Labels
permissions:
type: array
items:
type: string
enum:
- bypass-governance-retention
- reset-iam-organization-policy
uniqueItems: true
description: IAM Role permissions
assume-role-policy:
$ref: '#/components/schemas/iam-policy'
description: IAM Assume Role Policy
editable:
type: boolean
description: IAM Role mutability
name:
type: string
maxLength: 255
minLength: 1
description: IAM Role name
max-session-ttl:
type: integer
format: int64
description: Maximum TTL requester is allowed to ask for when assuming a role
exclusiveMinimum: 0
policy:
$ref: '#/components/schemas/iam-policy'
description: IAM Role Policy
id:
type: string
format: uuid
readOnly: true
description: IAM Role ID
description: IAM Role
iam-service-policy-rule:
type: object
properties:
action:
type: string
enum:
- allow
- deny
expression:
type: string
resources:
type: array
items:
type: string
iam-service-policy:
type: object
properties:
type:
type: string
enum:
- rules
- allow
- deny
rules:
type: array
items:
$ref: '#/components/schemas/iam-service-policy-rule'
operation:
type: object
properties:
id:
type: string
format: uuid
readOnly: true
description: Operation ID
reason:
type: string
enum:
- incorrect
- unknown
- unavailable
- forbidden
- busy
- fault
- partial
- not-found
- interrupted
- unsupported
- conflict
readOnly: true
description: Operation failure reason
reference:
type: object
properties:
id:
type: string
format: uuid
description: Reference ID
link:
type: string
readOnly: true
description: Link to the referenced resource
command:
type: string
description: Command name
description: Related resource reference
readOnly: true
message:
type: string
readOnly: true
description: Operation message
state:
type: string
enum:
- failure
- pending
- success
- timeout
readOnly: true
description: Operation status
description: Operation
iam-policy:
type: object
properties:
default-service-strategy:
type: string
enum:
- allow
- deny
description: IAM default service strategy
services:
type: object
additionalProperties:
$ref: '#/components/schemas/iam-service-policy'
description: IAM services
required:
- default-service-strategy
- services
description: Policy
labels:
type: object
additionalProperties:
type: string
x-topics:
- title: API Request Signature
content: '
In order to authenticate legitimate users, the Exoscale API requires incoming requests to be signed using valid Exoscale API account credentials with the following mechanism.
## Signature Mechanism
The *message* (i.e. content) to sign contains several segments concatenated using a line return character (`\n`).
All segments must be included and in the described order. For cases where a segment doesn''t fit the context of the request (e.g. no request body) **an empty line must be used instead**.
* Request method and request URL (path only), separated by a space character
* Request body
* Request URL parameters (Query String) values, concatenated without separator. The matching parameter names have to be specified in the resulting signature header `signed-query-args=` pragma, separated by semicolons (e.g. `p1;p2;pN`).
* Request header values, concatenated without separator (none at the moment, leave empty)
* Request expiration date in UNIX timestamp format
Example *message* to sign for `GET /v2/resource/a02baf5a-a3e4-49a0-857b-8a08d276c1c0?p1=v1&p2=v2`:
```
GET /v2/resource/a02baf5a-a3e4-49a0-857b-8a08d276c1c0
v1v2
1599140767
```
The two blank lines above are due to the absence of a request body and signed headers.
Example *message* to [create a security group](https://community.exoscale.com/reference/api/compute/security-group/#create-security-group)
```
POST /v2/security-group
{"name": "my-security-group"}
1599140767
```
The two blank lines above are due to the absence of query parameters and signed headers.
The request signature consists of the base64-encoded [HMAC](https://en.wikipedia.org/wiki/HMAC) hash of the UTF-8 encoded *message* and the Exoscale API secret using the SHA265 function:
```
signature = BASE64_ENCODE(HMAC_SHA256(Exoscale API secret, message))
```
Finally, the computed signature must be added to the API request in a `Authorization` header such as:
```
Authorization: EXO2-HMAC-SHA256 credential=<Exoscale API key>,expires=<expiration date UNIX timestamp>,signature=<signature>
```
Example API query:
```
GET /v2/resource/a02baf5a-a3e4-49a0-857b-8a08d276c1c0?p1=v1&p2=v2 HTTP/1.1
Host: api-ch-gva-2.exoscale.com
Authorization: EXO2-HMAC-SHA256 credential=EXO29147e9f89102b7ac1e88514,signed-query-args=p1;p2,expires=1599140767,signature=2AOBQsbElQb4FpKT/FM/9T4NobjlmZkSGvvdUth/xlY=
```
## Reference Implementations
You can look up the following existing reference implementations:
* Go: [github.com/exoscale/egoscale/api/v2 > `SecurityProviderExoscale.signRequest`](https://github.com/exoscale/egoscale/blob/master/v2/api/security.go)
* Python: [requests-exoscale-auth > `ExoscaleV2Auth`](https://github.com/exoscale/requests-exoscale-auth/blob/master/exoscale_auth.py)
'
- title: Zone local resources
content: '
The API is deployed across all Exoscale zones. When performing a compute call, you should use the relevant zone for your resource.
For example: https://api-de-fra-1.exoscale.com/v2/instance would return only the instances from `de-fra-1`, https://api-ch-gva-2.exoscale.com/v2/instance from `ch-gva-2`.
To obtain a list of all instances across all zones, you would need to do the corresponding request for each zone.
'