Querying the Authorization Summary of a Specified Service

Function

This API is used to query the authorization summary of a specified cloud service.

Authorization Information

No identity policy-based permission required for calling this API.

URI

GET /v5/authorization-schemas/services/{service_code}

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
service_code	Yes	String	Definition: Service name abbreviation. Constraints: The value contains 1 to 56 characters. Only letters, digits, and hyphens (-) are allowed. Range: N/A Default Value: N/A

Request Parameters

None

Response Parameters

Status code: 200

**Table 2** Response body parameters
Parameter	Type	Description
version	String	Definition: Version number of the service authorization summary. Range: N/A
actions	Array of actions objects	Definition: List of actions supported by a cloud service. Range: N/A
resources	Array of Resource objects	Definition: List of resources supported by a cloud service. Range: N/A
conditions	Array of conditions objects	Definition: List of condition keys supported by a cloud service. Range: N/A
operations	Array of operations objects	Definition: List of operations supported by a cloud service. Range: N/A

**Table 3** actions
Parameter	Type	Description
name	String	Definition: Action name. Range: N/A
access_level	String	Definition: Access level granted when this permission is used in a policy. Range: The value can be list, read, write, permission_management, or tagging.
permission_only	Boolean	Definition: Whether the action is used only as a permission point and does not correspond to any operation. Range: N/A
description	description object	Definition: Description. Range: N/A
aliases	Array of strings	Definition: List of action aliases, which is used to be compatible with scenarios where actions are renamed or split into new actions. Range: N/A
resources	Array of resources objects	Definition: List of resources associated with this action, which defines the resource-level permissions of the action. Range: N/A.
condition_keys	Array of strings	Definition: Service-defined condition attributes that are supported by the action and are irrelevant to resources, as well as some global attributes. Range: N/A

**Table 4** description
Parameter	Type	Description
en_US	String	Definition: Description in English. Range: N/A
zh_CN	String	Definition: Description in Chinese. Range: N/A

**Table 5** resources
Parameter	Type	Description
urn_template	String	Definition: Uniform resource name template, which indicates that the uniform resource name of this resource can be used to grant permissions to an action. Range: N/A
required	Boolean	Definition: Specifies whether a resource type is mandatory for this action. That is, the action must involve operations on this resource type. For example, subnet is a mandatory resource type of vpc:subnets:get, and ou is an optional resource type of organizations::tagResource. This is because that the resource operated by organizations::tagResource may also be an account or policy. Range: N/A
condition_keys	Array of strings	Definition: Service-defined condition attributes and some global attributes of this action and resource take effect only when this action and resource are matched. Range: N/A

**Table 6** Resource
Parameter	Type	Description
type_name	String	Definition: Resource type name of a cloud service. Constraints: The value contains 1 to 32 characters. Range: N/A Default Value: N/A
urn_template	String	Definition: Uniform resource name template, which indicates that the uniform resource name of this resource can be used to grant permissions to an action. Constraints: The length range is [1,1500]. Range: N/A Default Value: N/A

**Table 7** conditions
Parameter	Type	Description
key	String	Definition: Name of a condition key. Range: N/A
value_type	String	Definition: Data type of a condition value. Range: The value range can be string, numeric, date, boolean, or ip_address.
multi_valued	Boolean	Definition: Whether a condition value has multiple values. Range: The value can be true or false.
description	description object	Definition: Description. Range: N/A

**Table 8** description
Parameter	Type	Description
en_US	String	Definition: Description in English. Range: N/A
zh_CN	String	Definition: Description in Chinese. Range: N/A

**Table 9** operations
Parameter	Type	Description
operation_id	String	Definition: Operation identifier of the OpenAPI. Range: N/A
operation_action	String	Definition: Action name. Range: N/A
dependent_actions	Array of strings	Definition: Permissions for other actions that may be required for this operation. Range: N/A

Status code: 404

**Table 10** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Example Requests

Querying the authorization summary of a specified cloud service

GET https://{endpoint}/v5/authorization-schemas/services/{service_code}

Example Responses

Status code: 200

Successful

{
  "version" : "v1",
  "actions" : [ {
    "name" : "sts:agencies:assume",
    "access_level" : "write",
    "permission_only" : false,
    "description" : {
      "en_US" : "Grants permission to obtain a set of temporary credentials that you can use to access resources that you might not normally have access to.",
      "zh_CN" : "..."
    },
    "resources" : [ {
      "urn_template" : "iam::<account-id>:agency:<agency-name-with-path>",
      "required" : true
    } ],
    "condition_keys" : [ "sts:ExternalId", "sts:SourceIdentity", "sts:TransitiveTagKeys", "sts:AgencySessionName" ]
  }, {
    "name" : "sts::getCallerIdentity",
    "access_level" : "read",
    "permission_only" : false,
    "description" : {
      "en_US" : "Grants permission to obtain details about the IAM identity whose credentials are used to call the API.",
      "zh_CN" : "..."
    }
  }, {
    "name" : "sts::decodeAuthorizationMessage",
    "access_level" : "write",
    "permission_only" : false,
    "description" : {
      "en_US" : "Grants permission to decode additional information about the authorization status of a request from an encoded message returned in response to a request.",
      "zh_CN" : "..."
    }
  }, {
    "name" : "sts::setSourceIdentity",
    "access_level" : "write",
    "permission_only" : true,
    "description" : {
      "en_US" : "Grants permission to set a source identity on a STS session.",
      "zh_CN" : "..."
    },
    "resources" : [ {
      "urn_template" : "iam::<account-id>:agency:<agency-name-with-path>",
      "required" : true
    } ],
    "condition_keys" : [ "sts:SourceIdentity" ]
  }, {
    "name" : "sts::tagSession",
    "access_level" : "tagging",
    "permission_only" : true,
    "description" : {
      "en_US" : "Grants permission to add tags to a STS session.",
      "zh_CN" : "..."
    },
    "resources" : [ {
      "urn_template" : "iam::<account-id>:agency:<agency-name-with-path>",
      "required" : true
    } ],
    "condition_keys" : [ "sts:TransitiveTagKeys" ]
  } ],
  "resources" : [ {
    "type_name" : "assumed-agency",
    "urn_template" : "sts::<account-id>:assumed-agency:<agency-name>/<session-name>"
  } ],
  "conditions" : [ {
    "key" : "sts:ExternalId",
    "value_type" : "string",
    "multi_valued" : false,
    "description" : {
      "en_US" : "Filters access by the external ID that is passed in the request.",
      "zh_CN" : "..."
    }
  }, {
    "key" : "sts:SourceIdentity",
    "value_type" : "string",
    "multi_valued" : false,
    "description" : {
      "en_US" : "Filters access by the source identity that is passed in the request.",
      "zh_CN" : "..."
    }
  }, {
    "key" : "sts:TransitiveTagKeys",
    "value_type" : "string",
    "multi_valued" : true,
    "description" : {
      "en_US" : "Filters access by the transitive tag keys that are passed in the request.",
      "zh_CN" : "..."
    }
  }, {
    "key" : "sts:AgencySessionName",
    "value_type" : "string",
    "multi_valued" : false,
    "description" : {
      "en_US" : "Filters access by the agency session name required when you assume an agency.",
      "zh_CN" : "..."
    }
  } ],
  "operations" : [ {
    "operation_id" : "AssumeAgency",
    "operation_action" : "sts:agencies:assume",
    "dependent_actions" : [ "sts::tagSession", "sts::setSourceIdentity" ]
  }, {
    "operation_id" : "GetCallerIdentity",
    "operation_action" : "sts::getCallerIdentity"
  }, {
    "operation_id" : "DecodeAuthorizationMessage",
    "operation_action" : "sts::decodeAuthorizationMessage"
  } ]
}