Querying the Authorization Summary of a Specified Service

Function

This API is used to query the authorization summary of a specified cloud service.

Authorization Information

No identity policy-based permission required for calling this API.

URI

GET /v5/authorization-schemas/services/{service_code}

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
service_code	Yes	String	Definition Service name abbreviation. Constraints N/A Range The value contains 1 to 56 characters. Only letters, digits, and hyphens (-) are allowed. Default Value N/A

Request Parameters

None

Response Parameters

Status code: 200

**Table 2** Response body parameters
Parameter	Type	Description
version	String	Definition: Version number of the service authorization summary. Range: N/A
actions	Array of actions objects	Definition: List of actions supported by a cloud service. Range: N/A
resources	Array of Resource objects	Definition: List of resources supported by a cloud service. Range: N/A
conditions	Array of conditions objects	Definition: List of condition keys supported by a cloud service. Range: N/A
operations	Array of operations objects	Definition: List of operations supported by a cloud service. Range: N/A

**Table 3** actions
Parameter	Type	Description
name	String	Definition Action name. Range The value contains 1 to 128 characters. The value is in the three-segment format, for example, iam:policies:createV5.
access_level	String	Definition Access level granted when this permission is used in a policy. Range The value can be list, read, write, permission_management, or tagging. list: list permission read: read permission write: write permission permission_management: permission management permission tagging: tag management permission
permission_only	Boolean	Definition: Whether the action is used only as a permission point and does not correspond to any operation. Range: N/A
description	description object	Definition: Description. Range: N/A
aliases	Array of strings	Definition: List of action aliases, which is used to be compatible with scenarios where actions are renamed or split into new actions. Range: N/A
resources	Array of resources objects	Definition: List of resources associated with this action, which defines the resource-level permissions of the action. Range: N/A.
condition_keys	Array of strings	Definition: Service-defined condition attributes that are supported by the action and are irrelevant to resources, as well as some global attributes. Range: N/A

**Table 4** description
Parameter	Type	Description
en_US	String	Definition Description in English. Range The value contains 0 to 1,500 characters.
zh_CN	String	Definition Description in Chinese. Range The value contains 0 to 1,500 characters.

**Table 5** resources
Parameter	Type	Description
urn_template	String	Definition Uniform resource name template, which indicates that the uniform resource name of this resource can be used to grant permissions to an action. Range The length range is [1,1500].
required	Boolean	Definition: Specifies whether a resource type is mandatory for this action. That is, the action must involve operations on this resource type. For example, subnet is a mandatory resource type of vpc:subnets:get, and ou is an optional resource type of organizations::tagResource. This is because that the resource operated by organizations::tagResource may also be an account or policy. Range: N/A
condition_keys	Array of strings	Definition: Service-defined condition attributes and some global attributes of this action and resource take effect only when this action and resource are matched. Range: N/A

**Table 6** Resource
Parameter	Type	Description
type_name	String	Definition Resource type name of a cloud service. Range The value contains 1 to 32 characters.
urn_template	String	Definition Uniform resource name template, which indicates that the uniform resource name of this resource can be used to grant permissions to an action. Range The length range is [1,1500].

**Table 7** conditions
Parameter	Type	Description
key	String	Definition Name of a condition key. Range The value contains 1 to 128 characters.
value_type	String	Definition Data type of a condition value. Range The value range can be string, numeric, date, boolean, or ip_address. string: string numeric: numeric date: date boolean: Boolean ip_address: IP address
multi_valued	Boolean	Definition: Whether a condition value has multiple values. Range: The value can be true or false.
description	description object	Definition: Description. Range: N/A

**Table 8** description
Parameter	Type	Description
en_US	String	Definition Description in English. Range The value contains 0 to 1,500 characters.
zh_CN	String	Definition Description in Chinese. Range The value contains 0 to 1,500 characters.

**Table 9** operations
Parameter	Type	Description
operation_id	String	Definition Operation identifier of the OpenAPI. Range The value contains 1 to 64 characters.
operation_action	String	Definition Action name. Range The value contains 1 to 128 characters. The value is in the three-segment format, for example, iam:policies:createV5.
dependent_actions	Array of strings	Definition: Permissions for other actions that may be required for this operation. Range: N/A

Status code: 404

**Table 10** Response body parameters
Parameter	Type	Description
error_code	String	Definition: Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition: Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Example Requests

Querying the authorization summary of a specified cloud service

GET https://{endpoint}/v5/authorization-schemas/services/{service_code}

Example Responses

Status code: 200

{
  "version" : "v1",
  "actions" : [ {
    "name" : "sts:agencies:assume",
    "access_level" : "write",
    "permission_only" : false,
    "description" : {
      "en_US" : "Grants permission to obtain a set of temporary credentials that you can use to access resources that you might not normally have access to.",
      "zh_CN" : "..."
    },
    "resources" : [ {
      "urn_template" : "iam::<account-id>:agency:<agency-name-with-path>",
      "required" : true
    } ],
    "condition_keys" : [ "sts:ExternalId", "sts:SourceIdentity", "sts:TransitiveTagKeys", "sts:AgencySessionName" ]
  }, {
    "name" : "sts::getCallerIdentity",
    "access_level" : "read",
    "permission_only" : false,
    "description" : {
      "en_US" : "Grants permission to obtain details about the IAM identity whose credentials are used to call the API.",
      "zh_CN" : "..."
    }
  }, {
    "name" : "sts::decodeAuthorizationMessage",
    "access_level" : "write",
    "permission_only" : false,
    "description" : {
      "en_US" : "Grants permission to decode additional information about the authorization status of a request from an encoded message returned in response to a request.",
      "zh_CN" : "..."
    }
  }, {
    "name" : "sts::setSourceIdentity",
    "access_level" : "write",
    "permission_only" : true,
    "description" : {
      "en_US" : "Grants permission to set a source identity on a STS session.",
      "zh_CN" : "..."
    },
    "resources" : [ {
      "urn_template" : "iam::<account-id>:agency:<agency-name-with-path>",
      "required" : true
    } ],
    "condition_keys" : [ "sts:SourceIdentity" ]
  }, {
    "name" : "sts::tagSession",
    "access_level" : "tagging",
    "permission_only" : true,
    "description" : {
      "en_US" : "Grants permission to add tags to a STS session.",
      "zh_CN" : "..."
    },
    "resources" : [ {
      "urn_template" : "iam::<account-id>:agency:<agency-name-with-path>",
      "required" : true
    } ],
    "condition_keys" : [ "sts:TransitiveTagKeys" ]
  } ],
  "resources" : [ {
    "type_name" : "assumed-agency",
    "urn_template" : "sts::<account-id>:assumed-agency:<agency-name>/<session-name>"
  } ],
  "conditions" : [ {
    "key" : "sts:ExternalId",
    "value_type" : "string",
    "multi_valued" : false,
    "description" : {
      "en_US" : "Filters access by the external ID that is passed in the request.",
      "zh_CN" : "..."
    }
  }, {
    "key" : "sts:SourceIdentity",
    "value_type" : "string",
    "multi_valued" : false,
    "description" : {
      "en_US" : "Filters access by the source identity that is passed in the request.",
      "zh_CN" : "..."
    }
  }, {
    "key" : "sts:TransitiveTagKeys",
    "value_type" : "string",
    "multi_valued" : true,
    "description" : {
      "en_US" : "Filters access by the transitive tag keys that are passed in the request.",
      "zh_CN" : "..."
    }
  }, {
    "key" : "sts:AgencySessionName",
    "value_type" : "string",
    "multi_valued" : false,
    "description" : {
      "en_US" : "Filters access by the agency session name required when you assume an agency.",
      "zh_CN" : "..."
    }
  } ],
  "operations" : [ {
    "operation_id" : "AssumeAgency",
    "operation_action" : "sts:agencies:assume",
    "dependent_actions" : [ "sts::tagSession", "sts::setSourceIdentity" ]
  }, {
    "operation_id" : "GetCallerIdentity",
    "operation_action" : "sts::getCallerIdentity"
  }, {
    "operation_id" : "DecodeAuthorizationMessage",
    "operation_action" : "sts::decodeAuthorizationMessage"
  } ]
}