MongoDB Cloud Provider Access API

openapi: 3.2.0
info:
  description: "The MongoDB Atlas Administration API allows developers to manage all components in MongoDB Atlas.\n\nThe Atlas Administration API supports OAuth2 Service Accounts and HTTP Digest-based API keys. Service accounts are the recommended authentication method and API keys are considered a legacy option.\n\nTo authenticate with a Service Account, first exchange its client ID and secret for an access token using the OAuth 2.0 Client Credentials flow. Atlas provides a token endpoint at `POST https://cloud.mongodb.com/api/oauth/token`, which returns a Bearer token that is reusable and valid for 1 hour (3600 seconds).\n\nFor example, to [return a list of your organizations](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listorgs) with [cURL](https://en.wikipedia.org/wiki/CURL), first generate an access token and then use that token to call the same Atlas Administration API endpoint shown in the current example:\n\n```\nACCESS_TOKEN=$(curl -fsS --request POST https://cloud.mongodb.com/api/oauth/token \\\n  --header \"Authorization: Basic $(printf '%s' \"${CLIENT_ID}:${CLIENT_SECRET}\" | base64 | tr -d '\\n')\" \\\n  --header \"Content-Type: application/x-www-form-urlencoded\" \\\n  --header \"Accept: application/json\" \\\n  --data \"grant_type=client_credentials\" | jq -r '.access_token')\n\ncurl --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/orgs?pretty=true\"\n```\n\nIf your organization requires an IP access list for the Atlas Administration API, the token can be created from any IP address, but the API call that uses the token must originate from an allowed IP.\n\nTo learn more, see [Get Started with the Atlas Administration API](https://www.mongodb.com/docs/atlas/configure-api-access/). For support, see [MongoDB Support](https://www.mongodb.com/support/get-started).\n\nYou can also explore the various endpoints available through the Atlas Administration API in MongoDB's [Postman workspace](https://www.postman.com/mongodb-devrel/workspace/mongodb-atlas-administration-apis/) (requires a Postman account)."
  license:
    name: CC BY-NC-SA 3.0 US
    url: https://creativecommons.org/licenses/by-nc-sa/3.0/us/
  termsOfService: https://www.mongodb.com/mongodb-management-service-terms-and-conditions
  title: MongoDB Atlas Administration Access Tracking Cloud Provider Access API
  version: '2.0'
  x-xgen-sha: 3d70e065843c008b9871ea7836c98c9de6f202f9
servers:
- url: https://cloud.mongodb.com
security:
- ServiceAccounts: []
- DigestAuth: []
tags:
- description: Returns, adds, authorizes, and removes AWS IAM roles in Atlas.
  name: Cloud Provider Access
paths:
  /api/atlas/v2/groups/{groupId}/cloudProviderAccess:
    get:
      description: Returns all cloud provider access roles with access to the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
      operationId: listGroupCloudProviderAccess
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/pretty'
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/CloudProviderAccessRoles'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Return All Cloud Provider Access Roles
      tags:
      - Cloud Provider Access
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api cloudProviderAccess listCloudProviderAccess --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.ListGroupCloudProviderAccessApiParams{}\n\tsdkResp, httpResp, err := client.CloudProviderAccessApi.\n\t\tListGroupCloudProviderAccessWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess?pretty=true\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess?pretty=true\""
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Cloud-Provider-Access/operation/listGroupCloudProviderAccess
      x-xgen-operation-id-override: listCloudProviderAccess
    post:
      description: Creates one access role for the specified cloud provider. Some MongoDB Cloud features use these cloud provider access roles for authentication. To use this resource, the requesting Service Account or API Key must have the Project Owner role. For the GCP provider, if the project folder is not yet provisioned, Atlas will now create the role asynchronously. An intermediate role with status `IN_PROGRESS` will be returned, and the final service account will be provisioned. Once the GCP project is set up, subsequent requests will create the service account synchronously.
      externalDocs:
        description: Set Up Access to Cloud Providers
        url: https://www.mongodb.com/docs/atlas/security/cloud-provider-access/
      operationId: createGroupCloudProviderAccess
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/pretty'
      requestBody:
        content:
          application/vnd.atlas.2023-01-01+json:
            schema:
              $ref: '#/components/schemas/CloudProviderAccessRoleRequest'
        description: Creates one role for the specified cloud provider.
        required: true
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/CloudProviderAccessRole'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Create One Cloud Provider Access Role
      tags:
      - Cloud Provider Access
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api cloudProviderAccess createCloudProviderAccess --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.CreateGroupCloudProviderAccessApiParams{}\n\tsdkResp, httpResp, err := client.CloudProviderAccessApi.\n\t\tCreateGroupCloudProviderAccessWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess\" \\\n  -d '{ <Payload> }'"
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess\" \\\n  -d '{ <Payload> }'"
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Cloud-Provider-Access/operation/createGroupCloudProviderAccess
      x-xgen-operation-id-override: createCloudProviderAccess
  /api/atlas/v2/groups/{groupId}/cloudProviderAccess/{cloudProvider}/{roleId}:
    delete:
      description: Revokes access to the specified project for the specified access role. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
      operationId: deauthorizeGroupCloudProviderAccessRole
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/pretty'
      - description: Human-readable label that identifies the cloud provider of the role to deauthorize.
        in: path
        name: cloudProvider
        required: true
        schema:
          enum:
          - AWS
          - AZURE
          - GCP
          type: string
      - description: Unique 24-hexadecimal digit string that identifies the role.
        in: path
        name: roleId
        required: true
        schema:
          pattern: ^([a-f0-9]{24})$
          type: string
      responses:
        '204':
          content:
            application/vnd.atlas.2023-01-01+json:
              x-xgen-version: '2023-01-01'
          description: No Content
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '400':
          $ref: '#/components/responses/badRequest'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Deauthorize One Cloud Provider Access Role
      tags:
      - Cloud Provider Access
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api cloudProviderAccess deauthorizeProviderAccessRole --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.DeauthorizeGroupCloudProviderAccessRoleApiParams{}\n\thttpResp, err := client.CloudProviderAccessApi.\n\t\tDeauthorizeGroupCloudProviderAccessRoleWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess/{cloudProvider}/{roleId}\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess/{cloudProvider}/{roleId}\""
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Cloud-Provider-Access/operation/deauthorizeGroupCloudProviderAccessRole
      x-xgen-method-verb-override:
        customMethod: 'True'
        verb: deauthorizeRole
      x-xgen-operation-id-override: deauthorizeProviderAccessRole
  /api/atlas/v2/groups/{groupId}/cloudProviderAccess/{roleId}:
    get:
      description: Returns the access role with the specified id and with access to the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
      operationId: getGroupCloudProviderAccess
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/pretty'
      - description: Unique 24-hexadecimal digit string that identifies the role.
        in: path
        name: roleId
        required: true
        schema:
          pattern: ^([a-f0-9]{24})$
          type: string
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/CloudProviderAccessRole'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Return One Cloud Provider Access Role
      tags:
      - Cloud Provider Access
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api cloudProviderAccess getCloudProviderAccess --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.GetGroupCloudProviderAccessApiParams{}\n\tsdkResp, httpResp, err := client.CloudProviderAccessApi.\n\t\tGetGroupCloudProviderAccessWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess/{roleId}?pretty=true\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess/{roleId}?pretty=true\""
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Cloud-Provider-Access/operation/getGroupCloudProviderAccess
      x-xgen-operation-id-override: getCloudProviderAccess
    patch:
      description: Grants access to the specified project for the specified access role. To use this resource, the requesting Service Account or API Key must have the Project Owner role. This API endpoint is one step in a procedure to create unified access for MongoDB Cloud services. This is not required for GCP service account access.
      externalDocs:
        description: Set Up Access to Cloud Providers
        url: https://www.mongodb.com/docs/atlas/security/cloud-provider-access/
      operationId: authorizeGroupCloudProviderAccessRole
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/pretty'
      - description: Unique 24-hexadecimal digit string that identifies the role.
        in: path
        name: roleId
        required: true
        schema:
          pattern: ^([a-f0-9]{24})$
          type: string
      requestBody:
        content:
          application/vnd.atlas.2023-01-01+json:
            schema:
              $ref: '#/components/schemas/CloudProviderAccessRoleRequestUpdate'
        description: Grants access to the specified project for the specified access role.
        required: true
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/CloudProviderAccessRole'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '400':
          $ref: '#/components/responses/badRequest'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '409':
          $ref: '#/components/responses/conflict'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Authorize One Cloud Provider Access Role
      tags:
      - Cloud Provider Access
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api cloudProviderAccess authorizeProviderAccessRole --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.AuthorizeGroupCloudProviderAccessRoleApiParams{}\n\tsdkResp, httpResp, err := client.CloudProviderAccessApi.\n\t\tAuthorizeGroupCloudProviderAccessRoleWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess/{roleId}\" \\\n  -d '{ <Payload> }'"
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess/{roleId}\" \\\n  -d '{ <Payload> }'"
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Cloud-Provider-Access/operation/authorizeGroupCloudProviderAccessRole
      x-xgen-method-verb-override:
        customMethod: 'True'
        verb: authorizeRole
      x-xgen-operation-id-override: authorizeProviderAccessRole
components:
  schemas:
    CloudProviderAccessAWSIAMRole:
      allOf:
      - $ref: '#/components/schemas/CloudProviderAccessRole'
      - properties:
          atlasAWSAccountArn:
            description: Amazon Resource Name that identifies the Amazon Web Services (AWS) user account that MongoDB Cloud uses when it assumes the Identity and Access Management (IAM) role.
            example: arn:aws:iam::772401394250:role/my-test-aws-role
            maxLength: 2048
            minLength: 20
            readOnly: true
            type: string
          atlasAssumedRoleExternalId:
            description: Unique external ID that MongoDB Cloud uses when it assumes the IAM role in your Amazon Web Services (AWS) account.
            format: uuid
            readOnly: true
            type: string
          authorizedDate:
            description: Date and time when someone authorized this role for the specified cloud service provider. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
            format: date-time
            readOnly: true
            type: string
          createdDate:
            description: Date and time when someone created this role for the specified cloud service provider. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
            format: date-time
            readOnly: true
            type: string
          featureUsages:
            description: List that contains application features associated with this Amazon Web Services (AWS) Identity and Access Management (IAM) role.
            items:
              $ref: '#/components/schemas/CloudProviderAccessFeatureUsage'
            readOnly: true
            type: array
          iamAssumedRoleArn:
            description: Amazon Resource Name (ARN) that identifies the Amazon Web Services (AWS) Identity and Access Management (IAM) role that MongoDB Cloud assumes when it accesses resources in your AWS account.
            example: arn:aws:iam::123456789012:root
            maxLength: 2048
            minLength: 20
            type: string
          roleId:
            description: Unique 24-hexadecimal digit string that identifies the role.
            example: 32b6e34b3d91647abb20e7b8
            pattern: ^([a-f0-9]{24})$
            readOnly: true
            type: string
        type: object
      description: Details that describe the features linked to the Amazon Web Services (AWS) Identity and Access Management (IAM) role.
      required:
      - providerName
      type: object
    CloudProviderAccessRoleRequest:
      description: Cloud provider access role.
      discriminator:
        mapping:
          AWS: '#/components/schemas/CloudProviderAccessAWSIAMRoleRequest'
          AZURE: '#/components/schemas/CloudProviderAccessAzureServicePrincipalRequest'
          GCP: '#/components/schemas/CloudProviderAccessGCPServiceAccountRequest'
        propertyName: providerName
      oneOf:
      - $ref: '#/components/schemas/CloudProviderAccessAWSIAMRoleRequest'
      - $ref: '#/components/schemas/CloudProviderAccessAzureServicePrincipalRequest'
      - $ref: '#/components/schemas/CloudProviderAccessGCPServiceAccountRequest'
      properties:
        providerName:
          description: Human-readable label that identifies the cloud provider of the role.
          enum:
          - AWS
          - AZURE
          - GCP
          type: string
      required:
      - providerName
      type: object
    CloudProviderAccessGCPServiceAccount:
      allOf:
      - $ref: '#/components/schemas/CloudProviderAccessRole'
      - properties:
          createdDate:
            description: Date and time when this Google Service Account was created. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
            format: date-time
            readOnly: true
            type: string
          featureUsages:
            description: List that contains application features associated with this Google Service Account.
            items:
              $ref: '#/components/schemas/CloudProviderAccessFeatureUsage'
            readOnly: true
            type: array
          gcpServiceAccountForAtlas:
            description: Email address for the Google Service Account created by Atlas.
            pattern: ^mongodb-atlas-[0-9a-z]{16}@p-[0-9a-z]{24}.iam.gserviceaccount.com$
            type: string
          roleId:
            description: Unique 24-hexadecimal digit string that identifies the role.
            example: 32b6e34b3d91647abb20e7b8
            pattern: ^([a-f0-9]{24})$
            readOnly: true
            type: string
          status:
            description: Provision status of the service account.
            enum:
            - IN_PROGRESS
            - COMPLETE
            - FAILED
            - NOT_INITIATED
            readOnly: true
            type: string
        type: object
      description: Details that describe the features linked to the GCP Service Account.
      required:
      - providerName
      type: object
    CloudProviderAccessAzureServicePrincipalRequest:
      description: Details that describe the features linked to the Azure Service Principal.
      properties:
        _id:
          description: Unique 24-hexadecimal digit string that identifies the role.
          example: 32b6e34b3d91647abb20e7b8
          pattern: ^([a-f0-9]{24})$
          readOnly: true
          type: string
        atlasAzureAppId:
          description: Azure Active Directory Application ID of Atlas. This field is optional and will be derived from the Azure subscription if not provided.
          format: uuid
          type: string
        createdDate:
          description: Date and time when this Azure Service Principal was created. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
          format: date-time
          readOnly: true
          type: string
        featureUsages:
          description: List that contains application features associated with this Azure Service Principal.
          items:
            $ref: '#/components/schemas/CloudProviderAccessFeatureUsage'
          readOnly: true
          type: array
        lastUpdatedDate:
          description: Date and time when this Azure Service Principal was last updated. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
          format: date-time
          readOnly: true
          type: string
        providerName:
          description: Human-readable label that identifies the cloud provider of the role.
          enum:
          - AWS
          - AZURE
          - GCP
          type: string
        servicePrincipalId:
          description: UUID string that identifies the Azure Service Principal.
          format: uuid
          type: string
        tenantId:
          description: UUID String that identifies the Azure Active Directory Tenant ID.
          format: uuid
          type: string
      required:
      - providerName
      type: object
    ApiError:
      properties:
        badRequestDetail:
          $ref: '#/components/schemas/BadRequestDetail'
        detail:
          description: Describes the specific conditions or reasons that cause each type of error.
          type: string
        error:
          description: HTTP status code returned with this error.
          externalDocs:
            url: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status
          format: int32
          readOnly: true
          type: integer
        errorCode:
          description: Application error code returned with this error.
          readOnly: true
          type: string
        parameters:
          description: Parameters used to give more information about the error.
          items:
            type: object
          readOnly: true
          type: array
        reason:
          description: Application error message returned with this error.
          readOnly: true
          type: string
      required:
      - error
      - errorCode
      type: object
    CloudProviderAccessAzureServicePrincipal:
      allOf:
      - $ref: '#/components/schemas/CloudProviderAccessRole'
      - properties:
          _id:
            description: Unique 24-hexadecimal digit string that identifies the role.
            example: 32b6e34b3d91647abb20e7b8
            pattern: ^([a-f0-9]{24})$
            readOnly: true
            type: string
          atlasAzureAppId:
            description: Azure Active Directory Application ID of Atlas. This field is optional and will be derived from the Azure subscription if not provided.
            format: uuid
            type: string
          createdDate:
            description: Date and time when this Azure Service Principal was created. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
            format: date-time
            readOnly: true
            type: string
          featureUsages:
            description: List that contains application features associated with this Azure Service Principal.
            items:
              $ref: '#/components/schemas/CloudProviderAccessFeatureUsage'
            readOnly: true
            type: array
          lastUpdatedDate:
            description: Date and time when this Azure Service Principal was last updated. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
            format: date-time
            readOnly: true
            type: string
          servicePrincipalId:
            description: UUID string that identifies the Azure Service Principal.
            format: uuid
            type: string
          tenantId:
            description: UUID String that identifies the Azure Active Directory Tenant ID.
            format: uuid
            type: string
        type: object
      description: Details that describe the features linked to the Azure Service Principal.
      required:
      - providerName
      type: object
    FieldViolation:
      properties:
        description:
          description: A description of why the request element is bad.
          type: string
        field:
          description: A path that leads to a field in the request body.
          type: string
      required:
      - description
      - field
      type: object
    CloudProviderAccessAWSIAMRoleRequest:
      description: Details that describe the features linked to the Amazon Web Services (AWS) Identity and Access Management (IAM) role.
      properties:
        atlasAWSAccountArn:
          description: Amazon Resource Name that identifies the Amazon Web Services (AWS) user account that MongoDB Cloud uses when it assumes the Identity and Access Management (IAM) role.
          example: arn:aws:iam::772401394250:role/my-test-aws-role
          maxLength: 2048
          minLength: 20
          readOnly: true
          type: string
        atlasAssumedRoleExternalId:
          description: Unique external ID that MongoDB Cloud uses when it assumes the IAM role in your Amazon Web Services (AWS) account.
          format: uuid
          readOnly: true
          type: string
        authorizedDate:
          description: Date and time when someone authorized this role for the specified cloud service provider. This parameter expresses its value in the ISO 86

# --- truncated at 32 KB (44 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mongodb/refs/heads/main/openapi/mongodb-cloud-provider-access-api-openapi.yml