CLI Command Reference

Creating an Organization

hcloud Organizations CreateOrganization

This API is used to create an organization. The account whose user is calling this API automatically becomes the management account of the new organization. This API must be called using the credentials from the account that is to become the new organization's management account.

Go debug

Getting Organization Information

hcloud Organizations ShowOrganization

This API is used to get the information about the organization holding the account. It can be called by all accounts in an organization.

Go debug

Deleting an Organization

hcloud Organizations DeleteOrganization

This API is used to delete an organization. You must use the management account call this API. The organization must be empty of accounts, organizational units (OUs), and policies.

Go debug

Leaving an Organization

hcloud Organizations LeaveOrganization

This API is used to leave the current organization. It can be called only from a member account in the organization. You can leave an organization as a member account only if the account is configured with the information required for operating as a standalone account. The account to leave must not be a delegated administrator account for any cloud service enabled for your organization.

Go debug

Listing the Roots of an Organization

hcloud Organizations ListRoots

This API is used to list the roots of an organization. It can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service.

Go debug

Creating an OU

hcloud Organizations CreateOrganizationalUnit

This API is used to create an OU in a root or a parent OU. An OU is a container of accounts. It enables you to group your accounts to apply policies based on your business requirements. This API can be called only from the organization's management account.

Go debug

Listing OUs

hcloud Organizations ListOrganizationalUnits

This API is used to list all OUs in an organization. If a parent OU is specified, this API will return a list of all the OUs contained in the specified parent OU. This API can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service.

Go debug

Getting OU Information

hcloud Organizations ShowOrganizationalUnit

This API is used to get OU information. It can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service.

Go debug

Renaming an OU

hcloud Organizations UpdateOrganizationalUnit

This API is used to rename the specified OU. After an OU is renamed, its ID does not change, its child OUs and accounts remain in place, and any attached policies of the OU remain unchanged. This API can be called only from the organization's management account.

Go debug

Deleting an OU

hcloud Organizations DeleteOrganizationalUnit

This API is used to delete an OU from the root or another OU. Before deleting an OU, you must remove all member accounts from the OU or move them to another OU, and also remove the child OUs from the OU. This API can be called only from the organization's management account.

Go debug

Creating an Account

hcloud Organizations CreateAccount

This API is used to create an account. The generated account automatically becomes a member account of the organization holding the account that calls this API. This API can be called only from the organization's management account. The Organizations service creates the required service-linked agency and account-accessed agency in the new account.

Go debug

Listing Accounts in an Organization

hcloud Organizations ListAccounts

This API is used to list all the accounts in an organization. It can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service. If a parent OU is specified, this API will return a list of all the accounts contained in the specified parent OU.

Go debug

Creating an Account

hcloud Organizations CreateResourceAccount

This API is used to create an account. The generated account automatically becomes a member account of the organization holding the account that calls this API. This API can be called only from the organization's management account. The Organizations service creates the required service-linked agency and account-accessed agency in the new account.

Go debug

Closing an Account

hcloud Organizations CloseAccount

This API is used to close an account.

Go debug

Getting Account Information

hcloud Organizations ShowAccount

This API is used to get the information about the specified account. It can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service.

Go debug

Updating Account Information

hcloud Organizations UpdateAccount

This API is used to update an account.

Go debug

Removing the Specified Account

hcloud Organizations RemoveAccount

This API is used to remove the specified account from an organization. The removed account becomes a standalone account that is not a member account of any organization. This API can be called only from the organization's management account. You can remove an account from an organization only if the account is configured with the information required to operation as a standalone account. The account you want to remove must not be a delegated administrator account for any cloud service enabled for your organization.

Go debug

Moving an Account

hcloud Organizations MoveAccount

This API is used to move an account from its current source location (root or OU) to the specified destination location (root or OU).

Go debug

Inviting an Account to Join an Organization

hcloud Organizations InviteAccount

This API is used to send an invitation to another account. The invited account will join your organization as a member account. This API can be called only from the organization's management account.

Go debug

Querying Account Creation Requests in Specified State

hcloud Organizations ListCreateAccountStatuses

This API is used to query the account creation requests in the specified state for an organization. This API can be called only from the organization's management account or a delegated administrator account.

Go debug

Querying Account Creation Status

hcloud Organizations ShowCreateAccountStatus

This API is used to query the status of the asynchronous request to create an account. This API can be called only from the organization's management account or a delegated administrator account.

Go debug

Querying CloseAccount Requests in Specified State

hcloud Organizations ListCloseAccountStatuses

This API is used to query the CloseAccount requests in the specified state for an organization. This API can be called only from the organization's management account or a delegated administrator account.

Go debug

Getting Invitation Information

hcloud Organizations ShowHandshake

This API is used to get the information about existing invitations in an organization.

Go debug

Accepting an Invitation

hcloud Organizations AcceptHandshake

This API is used to accept an invitation to join an organization. After you accept an invitation, the invitation information continues to appear in the results of relevant APIs for 30 days.

Go debug

Declining an Invitation

hcloud Organizations DeclineHandshake

This API is used to decline an invitation to join an organization. This sets the invitation state to Declined and deactivates the invitation. This API can be called only from the account that received the invitation. The invitation initiator cannot re-activate a declined invitation but can re-initiate a new invitation.

Go debug

Canceling an Invitation

hcloud Organizations CancelHandshake

This API is used to cancel an invitation. This sets the invitation state to Canceled. This API can be called only from the account that initiated the invitation. After you cancel an invitation, the invitation information continues to appear in the results of relevant APIs for 30 days.

Go debug

Listing Received Invitations

hcloud Organizations ListReceivedHandshakes

This API is used to list all the invitations associated with the specified account. It can be called by any account.

Go debug

Listing Sent Invitations

hcloud Organizations ListHandshakes

This API is used to list all the invitations sent by an organization. It can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service.

Go debug

Enabling a Trusted Service

hcloud Organizations EnableTrustedService

This API is used to enable the integration of a cloud service (specified by service_principal) with Organizations. When you enable a trusted service, you allow the trusted service to create a service-linked agency in all accounts in your organization. This allows the trusted service to perform operations on your behalf in your organization and its accounts. This API can be called only from the organization's management account.

Go debug

Disabling a Trusted Service

hcloud Organizations DisableTrustedService

This API is used to disable the integration of a cloud service (specified by service_principal) with Organizations. After you disable a trusted service, the service no longer can create a service-linked agency in new accounts in your organization. This means the service no longer can perform operations on your behalf on any new accounts in your organization. The service can still perform operations in the old accounts until the service completes its cleanup from Organizations. This API can be called only from the organization's management account.

Go debug

Listing Trusted Services

hcloud Organizations ListTrustedServices

This API returns a list of trusted services that are integrated with Organizations. It can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service.

Go debug

Registering a Delegated Administrator

hcloud Organizations RegisterDelegatedAdministrator

This API is used to register the specified member account as a delegated administrator to manage the Organizations functions of a specified service. This API grants the delegated administrator the read-only access to Organizations service data. IAM users in the delegated administrator account still need IAM permissions to access and manage the specified service. This API can be called only from the organization's management account.

Go debug

Deregistering a Delegated Administrator

hcloud Organizations DeregisterDelegatedAdministrator

This API is used to remove the specified member account as the delegated administrator for the specified service. It can be called only from the organization's management account.

Go debug

Listing Services Managed by a Delegated Administrator Account

hcloud Organizations ListDelegatedServices

This API is used to list the services for which the specified account is a delegated administrator. It can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service.

Go debug

Listing Delegated Administrator Accounts

hcloud Organizations ListDelegatedAdministrators

This API is used to list the accounts that are designated as delegated administrators in an organization. It can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service.

Go debug

Creating a Policy

hcloud Organizations CreatePolicy

This API is used to create a policy of the specified type. It can be called only from the organization's management account.

Go debug

Listing Policies

hcloud Organizations ListPolicies

This API is used to list all policies in an organization. If a resource ID (such as an OU ID or account ID) is specified, this API will return a list of policies attached to the resource. This API can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service.

Go debug

Getting Policy Information

hcloud Organizations ShowPolicy

This API is used to get the information about the specified policy. It can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service.

Go debug

Updating a Policy

hcloud Organizations UpdatePolicy

This API is used to update the name, description, or content of a policy. If no parameter is provided, the policy remains unchanged. A policy's type cannot be changed. This API can be called only from the organization's management account.

Go debug

Deleting a Policy

hcloud Organizations DeletePolicy

This API is used to delete the specified account from an organization. Before calling this API, you must detach the policy from all OUs, roots, and accounts. This API can be called only from the organization's management account.

Go debug

Enabling a Policy Type for a Root

hcloud Organizations EnablePolicyType

This API is used to enable a policy type for a root of an organization. After you enable a policy type for the root, you can attach the policies of this type to the root, or any OU or account under the root. This is an asynchronous request executed in the background. You can use ListRoots to view the status of the policy types for the specified root. This API can be called only from the organization's management account.

Go debug

Disabling a Policy Type in a Root

hcloud Organizations DisablePolicyType

This API is used to disable a policy type in a root. A policy of a specific type can be attached to entities in a root only if that policy type is enabled in the root. After you call this API, you can no longer attach any policies of the specified type to that root or any OU or account in the root. This is an asynchronous request executed in the background. You can use ListRoots to view the status of the policy types for the specified root. This API can be called only from the organization's management account.

Go debug

Attaching a Policy to an Entity

hcloud Organizations AttachPolicy

This API is used to attach a policy to a root, OU, or individual account. It can be called only from the organization's management account.

Go debug

Detaching a Policy from an Entity

hcloud Organizations DetachPolicy

This API is used to detach a policy from a root, OU, or account. It can be called only from the organization's management account.

Go debug

Listing Entities for the Specified Policy

hcloud Organizations ListEntitiesForPolicy

This API is used to list all the entities (roots, OUs, and accounts) that the specified policy is attached to. It can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service.

Go debug

Listing Tags for the Specified Resource

hcloud Organizations ListTagsForResource

This API is used to list the tags that are attached to the specified resource. You can attach tags to the following resources in Organizations: accounts, OUs, roots, and policies. This API can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service.

Go debug

Adding Tags to the Specified Resource

hcloud Organizations TagResource

This API is used to add one or more tags to the specified resource. You can attach tags to the following resources in Organizations: accounts, OUs, roots, and policies. This API can be called only from the organization's management account.

Go debug

Removing Tags from the Specified Resource

hcloud Organizations UntagResource

This API is used to remove any tags with the specified key from the specified resource. You can attach tags to the following resources in Organizations: accounts, OUs, roots, and policies. This API can be called only from the organization's management account.

Go debug

Listing Tags for the Specified Resource

hcloud Organizations ListTagResources

This API is used to list the tags that are attached to the specified resource. You can attach tags to any of the following organization resources: accounts, OUs, roots, and policies. This API can be called only from the organization's management account or a delegated administrator account.

Go debug

Adding Tags to the Specified Resource

hcloud Organizations CreateTagResource

This API is used to add one or more tags to the specified resource. You can attach tags to any of the following organization resources: accounts, OUs, roots, and policies. This API can be called only from the organization's management account.

Go debug

Deleting Tags with the Specified Key from the Specified Resource

hcloud Organizations DeleteTagResource

This API is used to delete any tags with the specified key from the specified resource. You can attach tags to any of the following organization resources: accounts, OUs, roots, and policies. This API can be called only from the organization's management account.

Go debug

Querying Resource Instances by Resource Type and Tag

hcloud Organizations ListResourceInstances

This API is used to query the list of resource instances by resource type and tag.

Go debug

Querying Number of Resource Instances by Resource Type and Tag

hcloud Organizations ShowResourceInstancesCount

This API is used to query the number of resource instances by resource type and tag.

Go debug

Querying Resource Tags

hcloud Organizations ListResourceTags

This API is used to query tags attached to the specified resource.

Go debug

Querying Effective Policies

hcloud Organizations ShowEffectivePolicies

This API is used to query the effective policy of a specific type for the specified account. This API cannot be used to query the information about service control policies. This API can be called only from the organization's management account or a delegated administrator account.

Go debug

Listing Entities in an Organization

hcloud Organizations ListEntities

This API is used to list all the entities (roots, OUs, and accounts) in an organization. It can be called only from the organization's management account or from a member account that is a delegated administrator for a cloud service. You can filter entities you want to view by specifying the parent OU ID and child OU ID.

Go debug

Listing Cloud Services Integrable with Organizations

hcloud Organizations ListServices

This API is used to list all cloud services that can be integrated with Organizations. After a service on this list is integrated with Organizations, that service becomes a trusted service for Organizations.

Go debug

Listing Resource Types That Support Enforcement

hcloud Organizations ListTagPolicyServices

This API is used to list the resources types that support enforcement with tag policies.

Go debug

Listing Organizations Quotas

hcloud Organizations ListQuotas

This API is used to list Organizations quotas. It can be called only from the management account or a delegated administrator account.

Go debug

Querying Policy Dry Run Configurations of an Organization

hcloud Organizations ShowDryRunConfig

This API is used to query policy dry run configurations of an organization. It can be called only from the organization's management account or from a delegated administrator account of a cloud service.

Go debug

Updating Policy Dry Run Configurations of an Organization

hcloud Organizations UpdateDryRunConfig

This API is used to update policy dry run configurations of an organization. It can be called only from the organization's management account.

Go debug

Creating a Dry-Run Policy

hcloud Organizations CreateDryRunPolicy

This API is used to create a dry-run policy of a specified type. It can be called only from the organization's management account

Go debug

Listing Dry-Run Policies

hcloud Organizations ListDryRunPolicies

This API is used to list all dry-run policies of an organization. If a resource ID (such as an OU ID or account ID) is specified, this API will return a list of policies attached to the resource. It can be called only from the organization's management account or from a delegated administrator account of a cloud service.

Go debug

Querying Information about a Dry-Run Policy

hcloud Organizations ShowDryRunPolicy

This API is used to query information about a dry-run policy. It can be called only from the organization's management account or from a delegated administrator account of a cloud service.

Go debug

Update a Dry-Run Policy

hcloud Organizations UpdateDryRunPolicy

This API is used to update the name, description, or content of a dry-run policy. If no parameters are provided, the policy remains unchanged. You cannot change the policy type. It can be called only from the organization's management account.

Go debug

Deleting a Dry-Run Policy

hcloud Organizations DeleteDryRunPolicy

This API is used to delete a specified dry-run policy from an organization. Before calling this API, you must detach the policy from all OUs, roots, and accounts. It can be called only from the organization's management account.

Go debug

Attaching a Dry-Run Policy to an Entity

hcloud Organizations AttachDryRunPolicy

This API is used to attach a dry-run policy to the root, an OU, or an individual account. It can be called only from the organization's management account.

Go debug

Detaching a Dry-Run Policy from an Entity

hcloud Organizations DetachDryRunPolicy

This API is used to detach a dry-run policy from a root, an OU, or an account. It can be called only from the organization's management account.

Go debug

Listing All Entities Associated with the Specified Dry-Run Policy

hcloud Organizations ListEntitiesForDryRunPolicy

This API is used to list all the entities (roots, OUs, and accounts) that the specified dry-run policy is attached to. It can be called only from the organization's management account or from a delegated administrator account of a cloud service.

Go debug