API Gateway (APIG)

IAM provides system-defined identity policies to define typical cloud service permissions. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by apig, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by apig, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for apig.

**Table 1** Actions supported by apig
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
apig:acl:list	Grants permission to query all the access control policies.	List	instance *	g:ResourceTag/<tag-key>	apig:acls:list
apig:acl:create	Grants permission to create an access control policy.	Write	instance *	g:ResourceTag/<tag-key>	apig:acls:create
apig:acl:batchDelete	Grants permission to delete multiple access control policies.	Write	instance *	g:ResourceTag/<tag-key>	apig:acls:delete
apig:acl:delete	Grants permission to delete an access control policy.	Write	instance *	g:ResourceTag/<tag-key>	apig:acls:delete
apig:acl:get	Grants permission to query the details of an access control policy.	Read	instance *	g:ResourceTag/<tag-key>	apig:acls:get
apig:acl:update	Grants permission to modify an access control policy.	Write	instance *	g:ResourceTag/<tag-key>	apig:acls:update
apig:api:bindAcl	Grants permission to bind an access control policy to a specified API.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:bindAcls
apig:api:batchUnbindAcl	Grants permission to unbind multiple access control policies from APIs.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:unbindAcls
apig:api:unbindAcl	Grants permission to unbind an access control policy from an API.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:unbindAcls
apig:api:listBoundAcl	Grants permission to query the access control policies that have been bound to a specified API.	List	instance *	g:ResourceTag/<tag-key>	apig:apis:listBindedAcls
apig:acl:listBoundApi	Grants permission to to query the APIs to which an access control policy has been bound.	List	instance *	g:ResourceTag/<tag-key>	apig:acls:listBindedApis
apig:acl:listUnboundApi	Grants permission to query the published APIs to which an access control policy has not been bound.	List	instance *	g:ResourceTag/<tag-key>	apig:acls:listUnbindedApis
apig:api:bindRequestThrottling	Grants permission to bind a request throttling policy to an API that has been published in an environment.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:bindThrottles
apig:api:batchUnbindRequestThrottling	Grants permission to unbind request throttling policies from APIs.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:unbindThrottles
apig:api:unbindRequestThrottling	Grants permission to unbind a request throttling policy from an API.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:unbindThrottles
apig:requestThrottling:listBoundApi	Grants permission to query the APIs to which a specified request throttling policy has been bound.	List	instance *	g:ResourceTag/<tag-key>	apig:throttles:listBindedApis
apig:api:listBoundRequestThrottling	Grants permission to to query the request throttling policies that have been bound to an API.	List	instance *	g:ResourceTag/<tag-key>	apig:apis:listBindedThrottles
apig:requestThrottling:listUnboundApi	Grants permission to query the self-developed APIs to which a request throttling policy has not been bound.	List	instance *	g:ResourceTag/<tag-key>	apig:throttles:listUnbindedApis
apig:apiGroup:list	Grants permission to query API groups.	List	instance *	g:ResourceTag/<tag-key>	apig:groups:list
apig:apiGroup:create	Grants permission to create an API group. An API group is an API management unit and the entry to a service.	Write	instance *	g:ResourceTag/<tag-key>	apig:groups:create
apig:apiGroup:delete	Grants permission to delete an API group.	Write	instance *	g:ResourceTag/<tag-key>	apig:groups:delete
apig:apiGroup:get	Grants permission to query the details of an API group.	Read	instance *	g:ResourceTag/<tag-key>	apig:groups:get
apig:apiGroup:update	Grants permission to modify the attributes of an API group.	Write	instance *	g:ResourceTag/<tag-key>	apig:groups:update
apig:apiGroup:checkApiGroupNameExistOrNot	Grants permission to check whether the API group name exists.	Read	instance *	g:ResourceTag/<tag-key>	apig:groups:get
apig:api:list	Grants permission to query APIs to return details and publication information of the APIs.	List	instance *	g:ResourceTag/<tag-key>	apig:apis:list
apig:api:create	Grants permission to create an API.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:create
apig:api:delete	Grants permission to delete an API.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:delete
apig:api:get	Grants permission to query the details of an API.	Read	instance *	g:ResourceTag/<tag-key>	apig:apis:get
apig:api:update	Grants permission to modify the information about an API.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:update
apig:api:onlineOrOffline	Grants permission to publish an API or take an API offline.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:publish apig:apis:offline
apig:api:batchDelete	Grants permission to delete multiple APIs.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:delete
apig:api:checkApiPathOrApiNameExistOrNot	Grants permission to verify the API definition, that is, whether the API path or name already exists.	Read	instance *	g:ResourceTag/<tag-key>	apig:apis:get
apig:api:debug	Grants permission to debug an API.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:debug
apig:api:batchOnlineOrOffline	Grants permission to publish multiple APIs in an environment or to remove multiple APIs from the environment in which they have been published.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:publish apig:apis:offline
apig:api:listHistoryVersion	Grants permission to query the historical versions of an API.	List	instance *	g:ResourceTag/<tag-key>	apig:apis:get
apig:api:switchVersion	Grants permission to switch the version of an API.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:publish
apig:api:getRuntimeDefinition	Grants permission to query the runtime definition of an API in a specified environment.	Read	instance *	g:ResourceTag/<tag-key>	apig:apis:get
apig:api:deleteHistoryVersion	Grants permission to remove an effective version of an API.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:offline
apig:api:getHistoryVersion	Grants permission to query the details of a specified API version.	Read	instance *	g:ResourceTag/<tag-key>	apig:apis:get
apig:app:list	Grants permission to query apps.	List	instance *	g:ResourceTag/<tag-key>	apig:apps:list
apig:app:create	Grants permission to create an app.	Write	instance *	g:ResourceTag/<tag-key>	apig:apps:create
apig:app:delete	Grants permission to delete an app.	Write	instance *	g:ResourceTag/<tag-key>	apig:apps:delete
apig:app:get	Grants permission to query the details of an app.	Read	instance *	g:ResourceTag/<tag-key>	apig:apps:get
apig:app:update	Grants permission to modify the information about an app.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:update
apig:app:listAppCode	Grants permission to query the AppCodes of an app.	List	instance *	g:ResourceTag/<tag-key>	apig:appCodes:list
apig:app:createAppCode	Grants permission to create an AppCode for an app for simple authentication.	Write	instance *	g:ResourceTag/<tag-key>	apig:appCodes:create
apig:app:generateAppCode	Grants permission to generate a random AppCode.	Write	instance *	g:ResourceTag/<tag-key>	apig:appCodes:update
apig:app:deleteAppCode	Grants permission to delete an AppCode.	Write	instance *	g:ResourceTag/<tag-key>	apig:appCodes:delete
apig:app:getAppCode	Grants permission to query the details of an AppCode created for an app for simple authentication.	Read	instance *	g:ResourceTag/<tag-key>	apig:appCodes:get
apig:app:resetSecret	Grants permission to reset the AppSecret of an app.	Write	instance *	g:ResourceTag/<tag-key>	apig:apps:update
apig:app:validate	Grants permission to check whether an app exists.	Read	instance *	g:ResourceTag/<tag-key>	apig:apps:get
apig:app:getBoundQuota	Grants permission to query the application quota associated with a specified client application.	Read	instance *	g:ResourceTag/<tag-key>	apig:apps:get
apig:app:bindApi	Grants permission to bind the app to the API in the environment.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:grantAppAccess
apig:app:unbindApi	Grants permission to cancel the authorization of an app for accessing an API.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:relieveAppAccess
apig:app:listBoundApi	Grants permission to query the APIs to which a specified app has been bound.	List	instance *	g:ResourceTag/<tag-key>	apig:apps:listBindedApis
apig:api:listBoundApp	Grants permission to query the apps that have been bound to a specified API.	List	instance *	g:ResourceTag/<tag-key>	apig:apis:listBindedApps
apig:app:listUnboundApi	Grants permission to query the self-developed APIs to which an app has not been bound in a specified environment.	List	instance *	g:ResourceTag/<tag-key>	apig:apps:listUnbindedApis
apig:api:export	Grants permission to export APIs in a specified API group.	Read	instance *	g:ResourceTag/<tag-key>	apig:apis:export
apig:api:import	Grants permission to import APIs.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:import
apig:asyncTask:get	Grants permission to query the details of an async task.	Read	instance *	g:ResourceTag/<tag-key>	apig:apis:export apig:apis:import
apig:certificate:list	Grants permission to query the SSL certificates.	List	instance	g:ResourceTag/<tag-key>	-
apig:certificate:create	Grants permission to create an SSL certificate.	Write	instance	g:ResourceTag/<tag-key>	-
apig:certificate:delete	Grants permission to delete an SSL certificate.	Write	instance	g:ResourceTag/<tag-key>	-
apig:certificate:get	Grants permission to query the details about a certificate.	Read	instance	g:ResourceTag/<tag-key>	-
apig:certificate:update	Grants permission to modify an SSL certificate.	Write	instance	g:ResourceTag/<tag-key>	-
apig:certificate:listBoundDomain	Grants permission to query the domain names to which an SSL certificate has been bound.	List	instance	g:ResourceTag/<tag-key>	-
apig:certificate:batchBindDomain	Grants permission to bind an SSL certificate to a domain name.	Write	instance	g:ResourceTag/<tag-key>	-
apig:certificate:batchUnbindDomain	Grants permission to unbind an SSL certificate from a domain name.	Write	instance	g:ResourceTag/<tag-key>	-
apig:apiGroup:batchBindCertificateToDomain	Grants permission to bind a domain name with SSL certificates.	Write	instance *	g:ResourceTag/<tag-key>	apig:domains:bindCertificate
apig:apiGroup:batchUnbindCertificateFromDomain	Grants permission to unbind a domain name's SSL certificates.	Write	instance *	g:ResourceTag/<tag-key>	apig:domains:unbindCertificate
apig:loadBalanceChannel:list	Grants permission to query the VPC channels under a gateway.	List	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:list
apig:loadBalanceChannel:create	Grants permission to create a VPC channel from APIG to your private VPC resources.	Write	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:create
apig:loadBalanceChannel:delete	Grants permission to delete a VPC channel.	Write	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:delete
apig:loadBalanceChannel:get	Grants permission to query the details of a VPC channel.	Read	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:get
apig:loadBalanceChannel:update	Grants permission to update the parameters of a VPC channel.	Write	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:update
apig:loadBalanceChannel:updateHealthCheckConfig	Grants permission to modify the health check configuration of a VPC channel.	Write	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:update
apig:loadBalanceChannel:listServerGroup	Grants permission to query backend server groups of a VPC channel.	List	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:get
apig:loadBalanceChannel:createServerGroup	Grants permission to adding or Updating a Backend Server Group of a VPC Channel.	Write	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:addOrUpdateMemberGroups
apig:loadBalanceChannel:deleteServerGroup	Grants permission to delete a backend server group of a specified VPC channel.	Write	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:deleteMemberGroup
apig:loadBalanceChannel:getServerGroup	Grants permission to query a backend server group of a specified VPC channel.	Read	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:get
apig:loadBalanceChannel:updateServerGroup	Grants permission to update a backend server group of a VPC channel.	Write	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:updateMemberGroup
apig:loadBalanceChannel:listBackendServerAddress	Grants permission to query the backend instances of a specified VPC channel.	List	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:get
apig:loadBalanceChannel:createBackendServerAddress	Grants permission to add backend instances to a VPC channel.	Write	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:addInstance
apig:loadBalanceChannel:updateBackendServerAddress	Grants permission to update the backend instances of a specified VPC channel.	Write	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:addInstance
apig:loadBalanceChannel:deleteBackendServerAddress	Grants permission to delete a backend instance from a specified VPC channel.	Write	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:deleteInstance
apig:loadBalanceChannel:batchDisableBackendServerAddress	Grants permission to disable backend servers of a VPC channel.	Write	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:batchDisableInstance
apig:loadBalanceChannel:batchEnableBackendServerAddress	Grants permission to enable backend servers of a VPC channel.	Write	instance *	g:ResourceTag/<tag-key>	apig:vpcChannels:batchEnableInstance
apig:instance:listTag	Grants permission to query tags of a gateway.	List	instance *	g:ResourceTag/<tag-key>	apig:tags:list
apig:api:listUnboundPlugin	Grants permission to query the plug-ins that can be bound to a specified API.	List	instance *	g:ResourceTag/<tag-key>	apig:apis:listBindedPlugins
apig:api:listBoundPlugin	Grants permission to query the plug-ins bound to an API.	List	instance *	g:ResourceTag/<tag-key>	apig:apis:listBindedPlugins
apig:api:bindPlugin	Grants permission to bind an API with plug-ins.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:bindPlugins
apig:api:unbindPlugin	Grants permission to unbind an API's plug-ins.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:unbindPlugins
apig:plugin:list	Grants permission to query details about a group of plug-ins.	List	instance *	g:ResourceTag/<tag-key>	apig:plugins:list
apig:plugin:create	Grants permission to create a Plug-in.	Write	instance *	g:ResourceTag/<tag-key>	apig:plugins:create
apig:plugin:delete	Grants permission to delete a plug-in.	Write	instance *	g:ResourceTag/<tag-key>	apig:plugins:delete
apig:plugin:get	Grants permission to query the details of a plug-in.	Read	instance *	g:ResourceTag/<tag-key>	apig:plugins:get
apig:plugin:update	Grants permission to modify a plug-in.	Write	instance *	g:ResourceTag/<tag-key>	apig:plugins:update
apig:plugin:bindApi	Grants permission to bind a plug-in to APIs.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:bindPlugins
apig:plugin:listUnbindApi	Grants permission to query the APIs to which a plug-in can be bound.	List	instance *	g:ResourceTag/<tag-key>	apig:plugins:listUnbindedApis
apig:plugin:listBoundApi	Grants permission to query the APIs to which a plug-in has been bound.	List	instance *	g:ResourceTag/<tag-key>	apig:plugins:listBindedApis
apig:plugin:unbindApi	Grants permission to unbind a plug-in from all APIs to which it has been bound.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:unbindPlugins
apig:apiGroup:listGatewayResponse	Grants permission to query the responses of an API group.	List	instance *	g:ResourceTag/<tag-key>	apig:gatewayResponses:list
apig:apiGroup:createGatewayResponse	Grants permission to create a response for an API group.	Write	instance *	g:ResourceTag/<tag-key>	apig:gatewayResponses:create
apig:apiGroup:deleteGatewayResponse	Grants permission to delete a group response of an API group.	Write	instance *	g:ResourceTag/<tag-key>	apig:gatewayResponses:delete
apig:apiGroup:getGatewayResponse	Grants permission to query the details of a response defined for an API group.	Read	instance *	g:ResourceTag/<tag-key>	apig:gatewayResponses:get
apig:apiGroup:updateGatewayResponse	Grants permission to modify a response of an API group.	Write	instance *	g:ResourceTag/<tag-key>	apig:gatewayResponses:updat
apig:apiGroup:deleteGatewayResponseType	Grants permission to delete the response of an error type defined for an API group.	Write	instance *	g:ResourceTag/<tag-key>	apig:gatewayResponses:update
apig:apiGroup:getGatewayResponseType	Grants permission to query the response of an error type defined for an API group.	Read	instance *	g:ResourceTag/<tag-key>	apig:gatewayResponses:get
apig:apiGroup:updateGatewayResponseType	Grants permission to modify the response of an error type defined for an API group.	Write	instance *	g:ResourceTag/<tag-key>	apig:gatewayResponses:update
apig:instance:listApiOutline	Grants permission to to query the number of APIs that have been published in the RELEASE environment and the number of APIs that have not been published in this environment.	List	instance *	g:ResourceTag/<tag-key>	apig:apis:get
apig:instance:listAppOutline	Grants permission to query the number of apps that have been authorized to access APIs and the number of apps that have not been authorized to access any APIs.	List	instance *	g:ResourceTag/<tag-key>	apig:apps:get
apig:instance:listApiGroupOutline	Grants permission to query the number of API groups that have been listed on KooGallery and the number of API groups that have not been listed.	List	instance *	g:ResourceTag/<tag-key>	apig:groups:get
apig:environmentVariable:list	Grants permission to query all environment variables under an API group.	List	instance *	g:ResourceTag/<tag-key>	apig:variables:list
apig:environmentVariable:create	Grants permission to create an environment variable.	Write	instance *	g:ResourceTag/<tag-key>	apig:variables:create
apig:environmentVariable:delete	Grants permission to delete an environment variable.	Write	instance *	g:ResourceTag/<tag-key>	apig:variables:delete
apig:environmentVariable:get	Grants permission to query the details of an environment variable.	Read	instance *	g:ResourceTag/<tag-key>	apig:variables:get
apig:environmentVariable:update	Grants permission to modify an environment variable.	Write	instance *	g:ResourceTag/<tag-key>	apig:variables:update
apig:environment:list	Grants permission to query environments.	List	instance *	g:ResourceTag/<tag-key>	apig:envs:list
apig:environment:create	Grants permission to create an environment.	Write	instance *	g:ResourceTag/<tag-key>	apig:envs:create
apig:environment:delete	Grants permission to delete an environment.	Write	instance *	g:ResourceTag/<tag-key>	apig:envs:delete
apig:environment:update	Grants permission to modify the information about an environment.	Write	instance *	g:ResourceTag/<tag-key>	apig:envs:update
apig:instance:listMetricData	Grants permission to query the monitoring metric data at a specified granularity in a specified period of time.	List	instance *	g:ResourceTag/<tag-key>	apig:metricData:get
apig:instance:listApiMonitoring	Grants permission to query the number of times APIs in an API group are called within a period.	List	instance *	g:ResourceTag/<tag-key>	apig:apis:get
apig:instance:listApiGroupMonitoring	Grants permission to query the total number of times all APIs in an API group are called based on the API group ID.	List	instance *	g:ResourceTag/<tag-key>	apig:groups:get
apig:requestThrottling:list	Grants permission to query all the request throttling policies.	List	instance *	g:ResourceTag/<tag-key>	apig:throttles:list
apig:requestThrottling:create	Grants permission to create a request throttling policy.	Write	instance *	g:ResourceTag/<tag-key>	apig:throttles:create
apig:requestThrottling:delete	Grants permission to delete a request throttling policy and all binding relationships between the policy and APIs.	Write	instance *	g:ResourceTag/<tag-key>	apig:throttles:delete
apig:requestThrottling:get	Grants permission to query the details of a request throttling policy.	Read	instance *	g:ResourceTag/<tag-key>	apig:throttles:get
apig:requestThrottling:update	Grants permission to modify the information about a request throttling policy.	Write	instance *	g:ResourceTag/<tag-key>	apig:throttles:update
apig:requestThrottling:batchDelete	Grants permission to delete multiple request throttling policys and all binding relationships between these policies and APIs.	Write	instance *	g:ResourceTag/<tag-key>	apig:throttles:delete
apig:api:bindSignatureKey	Grants permission to bind a signature key to one or more published APIs.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:bindSigns
apig:api:unbindSignatureKey	Grants permission to unbind a signature key from an API.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:unbindSigns
apig:signatureKey:listBoundApi	Grants permission to query the APIs to which a signature key has been bound.	List	instance *	g:ResourceTag/<tag-key>	apig:signs:listBindedApis
apig:api:listBoundSignatureKey	Grants permission to query the signature keys that have been bound to a specified API.	List	instance *	g:ResourceTag/<tag-key>	apig:apis:listBindedSigns
apig:signatureKey:listUnboundApi	Grants permission to query the APIs to which a signature key has not been bound.	List	instance *	g:ResourceTag/<tag-key>	apig:signs:listUnbindedApis
apig:signatureKey:list	Grants permission to query all the signature keys.	List	instance *	g:ResourceTag/<tag-key>	apig:signs:list
apig:signatureKey:create	Grants permission to create a signature key.	Write	instance *	g:ResourceTag/<tag-key>	apig:signs:create
apig:signatureKey:delete	Grants permission to delete a signature key.	Write	instance *	g:ResourceTag/<tag-key>	apig:signs:delete
apig:signatureKey:update	Grants permission to modify the information about a signature key.	Write	instance *	g:ResourceTag/<tag-key>	apig:signs:update
apig:requestThrottling:listSpecial	Grants permission to query all excluded configurations of a request throttling policy.	List	instance *	g:ResourceTag/<tag-key>	apig:specialThrottles:get
apig:requestThrottling:createSpecial	Grants permission to create an excluded configuration of a request throttling policy.	Write	instance *	g:ResourceTag/<tag-key>	apig:specialThrottles:create
apig:requestThrottling:deleteSpecial	Grants permission to delete an excluded configuration of a request throttling policy.	Write	instance *	g:ResourceTag/<tag-key>	apig:specialThrottles:delete
apig:requestThrottling:updateSpecial	Grants permission to modify an excluded configuration of a request throttling policy.	Write	instance *	g:ResourceTag/<tag-key>	apig:specialThrottles:update
apig:instance:listSingleInstanceTag	Grants permission to query all tags of a gateway.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instanceTags:list
apig:instance:batchCreateOrDeleteTag	Grants permission to add tags to a gateway or delete the tags of a gateway.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instanceTags:create apig:instanceTags:delete
apig:instance:batchCreateOrDeleteTag		Write	-	g:RequestTag/<tag-key> g:TagKeys	apig:instanceTags:create apig:instanceTags:delete
apig::listTag	Grants permission to query all gateway tags of a project.	List	-	-	apig:instanceTags:list
apig:instance:getNumByTags	Grants permission to count dedicated gateways by tags.	Read	instance *	-	-
apig:instance:getNumByTags	Grants permission to count dedicated gateways by tags.	Read	-	g:TagKeys	-
apig:instance:listByTags	Grants permission to query dedicated gateways by tags.	List	instance *	-	-
apig:instance:listByTags	Grants permission to query dedicated gateways by tags.	List	-	g:TagKeys	-
apig:instance:list	Grants permission to query dedicated gateways.	List	-	-	apig:instances:list
apig:instance:create	Grants permission to create a dedicated gateway.	Write	-	g:RequestTag/<tag-key> g:TagKeys	apig:instances:create
apig:instance:delete	Grants permission to delete a dedicated gateway.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instances:delete
apig:instance:get	Grants permission to query the details of a dedicated gateway.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instances:get
apig:instance:update	Grants permission to update a dedicated gateway.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instances:update
apig:instance:unbindEip	Grants permission to unbind the EIP of a dedicated gateway.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instances:update
apig:instance:bindOrChangeEip	Grants permission to bind an EIP to a dedicated gateway or update the EIP bound to a dedicated gateway.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instances:update
apig:instance:deleteOutboundEip	Grants permission to disable public access for a dedicated gateway.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instances:update
apig:instance:createOutboundEip	Grants permission to enable public access for a dedicated gateway.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instances:update
apig:instance:changeOutboundEipBandwidth	Grants permission to update the outbound access bandwidth of a dedicated gateway.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instances:update
apig:instance:getCreateProgress	Grants permission to query the creation progress of a dedicated gateway.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
apig:instance:deleteIngressEip	Grants permission to disable inbound access for a dedicated gateway.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instances:update
apig:instance:createIngressEip	Grants permission to enable inbound access for a dedicated gateway.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instances:update
apig:instance:changeIngressEipBindwidth	Grants permission to update the inbound access bandwidth of a dedicated gateway.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instances:update
apig:instance:resize	Grants permission to create a flavor change order for a pay-per-use dedicated gateway.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
apig:instance:getRestriction	Grants permission to query th constraint of a gateway.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:instances:get
apig:instance:listParameter	Grants permission to query the features of a gateway.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:features:list
apig:instance:updateParameter	Grants permission to configure a feature for a gateway.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	apig:features:create
apig:instance:listFeature	Grants permission to the features supported by the dedicated gateway.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
apig:instance:importMicroservice	Grants permission to import a microservice.	Write	instance *	g:ResourceTag/<tag-key>	apig:apis:import
apig:apiGroup:bindDomain	Grants permission to binding a custom domain name from an API group.	Write	instance *	g:ResourceTag/<tag-key>	apig:domains:create
apig:apiGroup:unbindDomain	Grants permission to unbind a custom domain name from an API group.	Write	instance *	g:ResourceTag/<tag-key>	apig:domains:delete
apig:apiGroup:updateDomainConfig	Grants permission to modify the configuration of a domain name bound to an API group.	Write	instance *	g:ResourceTag/<tag-key>	apig:domains:update
apig:apiGroup:createAndBindCertificateToDomain	Grants permission to add a certificate to a specific domain name.	Write	instance *	g:ResourceTag/<tag-key>	apig:domains:bindCertificate
apig:apiGroup:unbindAndDeleteCertificateFromDomain	Grants permission to delete a certificate that is no longer needed or has expired.	Write	instance *	g:ResourceTag/<tag-key>	apig:domains:unbindCertificate
apig:apiGroup:getCertificateOfDomain	Grants permission to query the details of the certificate bound to a domain name.	Read	instance *	g:ResourceTag/<tag-key>	apig:domains:getCertificate
apig:apiGroup:updateSLDomainSetting	Grants permission to set whether the second-level domain can be accessed.	Write	instance *	g:ResourceTag/<tag-key>	apig:domains:updateSLDomainSetting
apig:customAuthorizer:list	Grants permission to query all the custom authorizers under a gateway.	List	instance *	g:ResourceTag/<tag-key>	apig:authorizers:list
apig:customAuthorizer:create	Grants permission to create a custom authorizer.	Write	instance *	g:ResourceTag/<tag-key>	apig:authorizers:create
apig:customAuthorizer:delete	Grants permission to delete a custom authorizer.	Write	instance *	g:ResourceTag/<tag-key>	apig:authorizers:delete
apig:customAuthorizer:get	Grants permission to query the details of a custom authorizer.	Read	instance *	g:ResourceTag/<tag-key>	apig:authorizers:get
apig:customAuthorizer:update	Grants permission to modify a custom authorizer.	Write	instance *	g:ResourceTag/<tag-key>	apig:authorizers:update
apig:instance:listVpcEndpoint	Grants permission to query connections of a dedicated gateway VPC endpoint service.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
apig:instance:acceptOrRejectVpcEndpointConnection	Grants permission to accept or reject a dedicated gateway VPC endpoint for a VPC endpoint service.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
apig:instance:listVpcEndpointPermission	Grants permission to query the whitelist records of a dedicated gateway VPC endpoint service.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
apig:instance:batchAddVpcEndpointPermission	Grants permission to batch add whitelist records of a dedicated gateway VPC endpoint service.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
apig:instance:batchDeleteVpcEndpointPermission	Grants permission to batch delete whitelist records of a dedicated gateway VPC endpoint service.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
apig:app:deleteAcl	Grants permission to delete access control for a client configuration.	Write	instance *	g:ResourceTag/<tag-key>	apig:apps:get
apig:app:getAcl	Grants permission to query the details about the app access control.	Read	instance *	g:ResourceTag/<tag-key>	apig:apps:get
apig:app:updateAcl	Grants permission to onfigure access control for a client configuration.	Write	instance *	g:ResourceTag/<tag-key>	apig:apps:get
apig:clientQuota:list	Grants permission to query client quotas.	List	instance *	g:ResourceTag/<tag-key>	-
apig:clientQuota:create	Grants permission to create a client quota.	Write	instance *	g:ResourceTag/<tag-key>	-
apig:clientQuota:delete	Grants permission to delete a client quota.	Write	instance *	g:ResourceTag/<tag-key>	-
apig:clientQuota:get	Grants permission to querying the details of a client quota.	Read	instance *	g:ResourceTag/<tag-key>	-
apig:clientQuota:update	Grants permission to modify a client quota.	Write	instance *	g:ResourceTag/<tag-key>	-
apig:clientQuota:listBoundApp	Grants permission to query client applications bound to a client quota.	List	instance *	g:ResourceTag/<tag-key>	-
apig:clientQuota:bindApp	Grants permission to bind client applications to a client quota.	Write	instance *	g:ResourceTag/<tag-key>	-
apig:clientQuota:unbindApp	Grants permission to unbind client applications from a client quota.	Write	instance *	g:ResourceTag/<tag-key>	-
apig:clientQuota:listUnboundApp	Grants permission to query client applications that are available for being bound to a client quota.	List	instance *	g:ResourceTag/<tag-key>	-
apig:instance:listFeatureHistory	Grants permission to query the history list of feature	List	instance *	g:ResourceTag/<tag-key>	-
apig:instance:addCustomIngressPort	Grants permission to add customized ingress ports of the instance.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
apig:instance:listCustomIngressPort	Grants permission to query customized ingress ports of the instance.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
apig:instance:deleteCustomIngressPort	Grants permission to delete customized ingress ports of the instance.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
apig:instance:listCustomIngressPortDomain	Grants permission to query the domains info of a customized ingress port.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-

Each API of apig usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by apig APIs
API	Action	Dependencies
GET /{project_id}/apigw/instances/{instance_id}/acls	apig:acl:list	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/acls	apig:acl:create	apig:instance:get
PUT /{project_id}/apigw/instances/{instance_id}/acls	apig:acl:batchDelete	apig:instance:get
DELETE /{project_id}/apigw/instances/{instance_id}/acls/{acl_id}	apig:acl:delete	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/acls/{acl_id}	apig:acl:get	apig:instance:get
PUT /{project_id}/apigw/instances/{instance_id}/acls/{acl_id}	apig:acl:update	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/acl-bindings	apig:api:bindAcl	apig:instance:get apig:api:get apig:acl:get
PUT /{project_id}/apigw/instances/{instance_id}/acl-bindings	apig:api:batchUnbindAcl	apig:instance:get apig:api:get apig:acl:get
DELETE /{project_id}/apigw/instances/{instance_id}/acl-bindings/{acl_bindings_id}	apig:api:unbindAcl	apig:instance:get apig:api:get apig:acl:get
GET /{project_id}/apigw/instances/{instance_id}/acl-bindings/binded-acls	apig:api:listBoundAcl	apig:instance:get apig:api:get
GET /{project_id}/apigw/instances/{instance_id}/acl-bindings/binded-apis	apig:acl:listBoundApi	apig:instance:get apig:acl:get
GET /{project_id}/apigw/instances/{instance_id}/acl-bindings/unbinded-apis	apig:acl:listUnboundApi	apig:instance:get apig:acl:get
POST /{project_id}/apigw/instances/{instance_id}/throttle-bindings	apig:api:bindRequestThrottling	apig:instance:get apig:api:get apig:requestThrottling:get
PUT /{project_id}/apigw/instances/{instance_id}/throttle-bindings	apig:api:batchUnbindRequestThrottling	apig:instance:get apig:api:get apig:requestThrottling:get
DELETE /{project_id}/apigw/instances/{instance_id}/throttle-bindings/{throttle_binding_id}	apig:api:unbindRequestThrottling	apig:instance:get apig:api:get apig:requestThrottling:get
GET /{project_id}/apigw/instances/{instance_id}/throttle-bindings/binded-apis	apig:requestThrottling:listBoundApi	apig:instance:get apig:requestThrottling:get
GET /{project_id}/apigw/instances/{instance_id}/throttle-bindings/binded-throttles	apig:api:listBoundRequestThrottling	apig:instance:get apig:api:get
GET /{project_id}/apigw/instances/{instance_id}/throttle-bindings/unbinded-apis	apig:requestThrottling:listUnboundApi	apig:instance:get apig:requestThrottling:get
GET /{project_id}/apigw/instances/{instance_id}/api-groups	apig:apiGroup:list	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/api-groups	apig:apiGroup:create	apig:instance:get
DELETE /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}	apig:apiGroup:delete	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}	apig:apiGroup:get	apig:instance:get
PUT /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}	apig:apiGroup:update	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/api-groups/check	apig:apiGroup:checkApiGroupNameExistOrNot	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/apis	apig:api:list	apig:instance:get apig:apiGroup:get
POST /{project_id}/apigw/instances/{instance_id}/apis	apig:api:create	apig:instance:get apig:apiGroup:get apig:loadBalanceChannel:get apig:customAuthorizer:get functiongraph:function:getFunctionConfig
DELETE /{project_id}/apigw/instances/{instance_id}/apis/{api_id}	apig:api:delete	apig:instance:get apig:apiGroup:get
GET /{project_id}/apigw/instances/{instance_id}/apis/{api_id}	apig:api:get	apig:instance:get apig:apiGroup:get
PUT /{project_id}/apigw/instances/{instance_id}/apis/{api_id}	apig:api:update	apig:instance:get apig:apiGroup:get apig:loadBalanceChannel:get apig:customAuthorizer:get functiongraph:function:getFunctionConfig
POST /{project_id}/apigw/instances/{instance_id}/apis/action	apig:api:onlineOrOffline	apig:instance:get apig:apiGroup:get apig:environment:list
POST /{project_id}/apigw/instances/{instance_id}/apis/check	apig:api:checkApiPathOrApiNameExistOrNot	apig:instance:get apig:apiGroup:get
POST /{project_id}/apigw/instances/{instance_id}/apis/debug/{api_id}	apig:api:debug	apig:instance:get apig:apiGroup:get
POST /{project_id}/apigw/instances/{instance_id}/apis/publish	apig:api:batchOnlineOrOffline	apig:instance:get apig:apiGroup:get apig:environment:list
GET /{project_id}/apigw/instances/{instance_id}/apis/publish/{api_id}	apig:api:listHistoryVersion	apig:instance:get
PUT /{project_id}/apigw/instances/{instance_id}/apis/publish/{api_id}	apig:api:switchVersion	apig:instance:get apig:api:get
GET /{project_id}/apigw/instances/{instance_id}/apis/runtime/{api_id}	apig:api:getRuntimeDefinition	apig:instance:get apig:environment:list
DELETE /{project_id}/apigw/instances/{instance_id}/apis/versions/{version_id}	apig:api:deleteHistoryVersion	apig:instance:get apig:apiGroup:get apig:environment:list
GET /{project_id}/apigw/instances/{instance_id}/apis/versions/{version_id}	apig:api:getHistoryVersion	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/apps	apig:app:list	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/apps	apig:app:create	apig:instance:get
DELETE /{project_id}/apigw/instances/{instance_id}/apps/{app_id}	apig:app:delete	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/apps/{app_id}	apig:app:get	apig:instance:get
PUT /{project_id}/apigw/instances/{instance_id}/apps/{app_id}	apig:app:update	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes	apig:app:listAppCode	apig:instance:get apig:app:get
POST /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes	apig:app:createAppCode	apig:instance:get apig:app:get
PUT /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes	apig:app:generateAppCode	apig:instance:get apig:app:get
DELETE /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes/{app_code_id}	apig:app:deleteAppCode	apig:instance:get apig:app:get
GET /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes/{app_code_id}	apig:app:getAppCode	apig:instance:get apig:app:get
PUT /{project_id}/apigw/instances/{instance_id}/apps/secret/{app_id}	apig:app:resetSecret	apig:instance:get apig:app:get
GET /{project_id}/apigw/instances/{instance_id}/apps/validation/{app_id}	apig:app:validate	apig:instance:get apig:app:get
GET /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/bound-quota	apig:app:getBoundQuota	apig:instance:get apig:app:get
POST /{project_id}/apigw/instances/{instance_id}/app-auths	apig:app:bindApi	apig:instance:get apig:app:get apig:api:get
DELETE /{project_id}/apigw/instances/{instance_id}/app-auths/{app_auth_id}	apig:app:unbindApi	apig:instance:get apig:app:get apig:api:get
GET /{project_id}/apigw/instances/{instance_id}/app-auths/binded-apis	apig:app:listBoundApi	apig:instance:get apig:app:get
GET /{project_id}/apigw/instances/{instance_id}/app-auths/binded-apps	apig:api:listBoundApp	apig:instance:get apig:api:get
GET /{project_id}/apigw/instances/{instance_id}/app-auths/unbinded-apis	apig:app:listUnboundApi	apig:instance:get apig:app:get
POST /{project_id}/apigw/instances/{instance_id}/openapi/export	apig:api:export	apig:instance:get apig:api:list apig:api:get apig:api:listBoundAcl apig:acl:get apig:api:listBoundRequestThrottling apig:requestThrottling:get apig:apiGroup:get apig:apiGroup:getGatewayResponse apig:environment:list apig:api:listBoundPlugin apig:plugin:get
POST /{project_id}/apigw/instances/{instance_id}/openapi/async-export	apig:api:export	apig:instance:get apig:api:list apig:api:get apig:api:listBoundAcl apig:acl:get apig:api:listBoundRequestThrottling apig:requestThrottling:get apig:apiGroup:get apig:apiGroup:getGatewayResponse apig:environment:list apig:api:listBoundPlugin apig:plugin:get
POST /{project_id}/apigw/instances/{instance_id}/openapi/import	apig:api:import	apig:instance:get apig:api:get apig:acl:get apig:requestThrottling:get apig:apiGroup:get apig:apiGroup:getGatewayResponse apig:environment:list apig:plugin:get
POST /{project_id}/apigw/instances/{instance_id}/openapi/async-import	apig:api:import	apig:instance:get apig:api:get apig:acl:get apig:requestThrottling:get apig:apiGroup:get apig:apiGroup:getGatewayResponse apig:environment:list apig:plugin:get
GET /{project_id}/apigw/instances/{instance_id}/async-tasks/{task_id}	apig:asyncTask:get	apig:instance:get
GET /{project_id}/apigw/certificates	apig:certificate:list	-
POST /{project_id}/apigw/certificates	apig:certificate:create	apig:instance:get
DELETE /{project_id}/apigw/certificates/{certificate_id}	apig:certificate:delete	-
GET /{project_id}/apigw/certificates/{certificate_id}	apig:certificate:get	-
PUT /{project_id}/apigw/certificates/{certificate_id}	apig:certificate:update	apig:instance:get
GET /{project_id}/apigw/certificates/{certificate_id}/attached-domains	apig:certificate:listBoundDomain	-
POST /{project_id}/apigw/certificates/{certificate_id}/domains/attach	apig:certificate:batchBindDomain	apig:certificate:get apig:apiGroup:get
POST /{project_id}/apigw/certificates/{certificate_id}/domains/detach	apig:certificate:batchUnbindDomain	apig:certificate:get apig:apiGroup:get
POST /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificates/attach	apig:apiGroup:batchBindCertificateToDomain	apig:instance:get apig:apiGroup:get apig:certificate:get
POST /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificates/detach	apig:apiGroup:batchUnbindCertificateFromDomain	apig:instance:get apig:apiGroup:get apig:certificate:get
GET /{project_id}/apigw/instances/{instance_id}/vpc-channels	apig:loadBalanceChannel:list	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/vpc-channels	apig:loadBalanceChannel:create	apig:instance:get cce:cluster:getCluster ecs:cloudServers:showServer cce:cluster:generateClientCredential
DELETE /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}	apig:loadBalanceChannel:delete	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}	apig:loadBalanceChannel:get	apig:instance:get
PUT /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}	apig:loadBalanceChannel:update	apig:instance:get cce:cluster:getCluster ecs:cloudServers:showServer cce:cluster:generateClientCredential
PUT /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/health-config	apig:loadBalanceChannel:updateHealthCheckConfig	apig:instance:get apig:loadBalanceChannel:get
GET /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/member-groups	apig:loadBalanceChannel:listServerGroup	apig:instance:get apig:loadBalanceChannel:get
POST /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/member-groups	apig:loadBalanceChannel:createServerGroup	apig:instance:get apig:loadBalanceChannel:get
DELETE /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/member-groups/{member_group_id}	apig:loadBalanceChannel:deleteServerGroup	apig:instance:get apig:loadBalanceChannel:get
GET /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/member-groups/{member_group_id}	apig:loadBalanceChannel:getServerGroup	apig:instance:get apig:loadBalanceChannel:get
PUT /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/member-groups/{member_group_id}	apig:loadBalanceChannel:updateServerGroup	apig:instance:get apig:loadBalanceChannel:get
GET /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members	apig:loadBalanceChannel:listBackendServerAddress	apig:instance:get apig:loadBalanceChannel:get
POST /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members	apig:loadBalanceChannel:createBackendServerAddress	apig:instance:get apig:loadBalanceChannel:get ecs:cloudServers:showServer
PUT /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members	apig:loadBalanceChannel:updateBackendServerAddress	apig:instance:get apig:loadBalanceChannel:get ecs:cloudServers:showServer
DELETE /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members/{member_id}	apig:loadBalanceChannel:deleteBackendServerAddress	apig:instance:get apig:loadBalanceChannel:get
POST /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members/batch-disable	apig:loadBalanceChannel:batchDisableBackendServerAddress	apig:instance:get apig:loadBalanceChannel:get
POST /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members/batch-enable	apig:loadBalanceChannel:batchEnableBackendServerAddress	apig:instance:get apig:loadBalanceChannel:get
GET /{project_id}/apigw/instances/{instance_id}/tags	apig:instance:listTag	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/apis/{api_id}/attachable-plugins	apig:api:listUnboundPlugin	apig:instance:get apig:api:get
GET /{project_id}/apigw/instances/{instance_id}/apis/{api_id}/attached-plugins	apig:api:listBoundPlugin	apig:instance:get apig:api:get
POST /{project_id}/apigw/instances/{instance_id}/apis/{api_id}/plugins/attach	apig:api:bindPlugin	apig:instance:get apig:api:get apig:plugin:get
PUT /{project_id}/apigw/instances/{instance_id}/apis/{api_id}/plugins/detach	apig:api:unbindPlugin	apig:instance:get apig:api:get apig:plugin:get
GET /{project_id}/apigw/instances/{instance_id}/plugins	apig:plugin:list	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/plugins	apig:plugin:create	apig:instance:get apig:loadBalanceChannel:get functiongraph:function:getFunctionConfig
DELETE /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}	apig:plugin:delete	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}	apig:plugin:get	apig:instance:get
PUT /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}	apig:plugin:update	apig:instance:get apig:loadBalanceChannel:get functiongraph:function:getFunctionConfig
POST /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}/attach	apig:plugin:bindApi	apig:instance:get apig:api:get apig:plugin:get
GET /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}/attachable-apis	apig:plugin:listUnbindApi	apig:instance:get apig:plugin:get
GET /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}/attached-apis	apig:plugin:listBoundApi	apig:instance:get apig:plugin:get
PUT /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}/detach	apig:plugin:unbindApi	apig:instance:get apig:api:get apig:plugin:get
GET /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses	apig:apiGroup:listGatewayResponse	apig:instance:get apig:apiGroup:get
POST /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses	apig:apiGroup:createGatewayResponse	apig:instance:get apig:apiGroup:get
DELETE /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}	apig:apiGroup:deleteGatewayResponse	apig:instance:get apig:apiGroup:get
GET /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}	apig:apiGroup:getGatewayResponse	apig:instance:get apig:apiGroup:get
PUT /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}	apig:apiGroup:updateGatewayResponse	apig:instance:get apig:apiGroup:get
DELETE /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}/{response_type}	apig:apiGroup:deleteGatewayResponseType	apig:instance:get apig:apiGroup:get
GET /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}/{response_type}	apig:apiGroup:getGatewayResponseType	apig:instance:get apig:apiGroup:get
PUT /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}/{response_type}	apig:apiGroup:updateGatewayResponseType	apig:instance:get apig:apiGroup:get
GET /{project_id}/apigw/instances/{instance_id}/resources/outline/apis	apig:instance:listApiOutline	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/resources/outline/apps	apig:instance:listAppOutline	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/resources/outline/groups	apig:instance:listApiGroupOutline	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/env-variables	apig:environmentVariable:list	apig:instance:get apig:apiGroup:get apig:environment:list
POST /{project_id}/apigw/instances/{instance_id}/env-variables	apig:environmentVariable:create	apig:instance:get apig:apiGroup:get apig:environment:list
DELETE /{project_id}/apigw/instances/{instance_id}/env-variables/{env_variable_id}	apig:environmentVariable:delete	apig:instance:get apig:apiGroup:get apig:environment:list
GET /{project_id}/apigw/instances/{instance_id}/env-variables/{env_variable_id}	apig:environmentVariable:get	apig:instance:get apig:apiGroup:get apig:environment:list
PUT /{project_id}/apigw/instances/{instance_id}/env-variables/{env_variable_id}	apig:environmentVariable:update	apig:instance:get apig:apiGroup:get apig:environment:list
GET /{project_id}/apigw/instances/{instance_id}/envs	apig:environment:list	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/envs	apig:environment:create	apig:instance:get
DELETE /{project_id}/apigw/instances/{instance_id}/envs/{env_id}	apig:environment:delete	apig:instance:get
PUT /{project_id}/apigw/instances/{instance_id}/envs/{env_id}	apig:environment:update	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/metric-data	apig:instance:listMetricData	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/statistics/api/latest	apig:instance:listApiMonitoring	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/statistics/group/latest	apig:instance:listApiGroupMonitoring	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/throttles	apig:requestThrottling:list	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/throttles	apig:requestThrottling:create	apig:instance:get
DELETE /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}	apig:requestThrottling:delete	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}	apig:requestThrottling:get	apig:instance:get
PUT /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}	apig:requestThrottling:update	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/sign-bindings	apig:api:bindSignatureKey	apig:instance:get apig:api:get apig:signatureKey:list
DELETE /{project_id}/apigw/instances/{instance_id}/sign-bindings/{sign_bindings_id}	apig:api:unbindSignatureKey	apig:instance:get apig:api:get apig:signatureKey:list
GET /{project_id}/apigw/instances/{instance_id}/sign-bindings/binded-apis	apig:signatureKey:listBoundApi	apig:instance:get apig:signatureKey:list
GET /{project_id}/apigw/instances/{instance_id}/sign-bindings/binded-signs	apig:api:listBoundSignatureKey	apig:instance:get apig:api:get
GET /{project_id}/apigw/instances/{instance_id}/sign-bindings/unbinded-apis	apig:signatureKey:listUnboundApi	apig:instance:get apig:signatureKey:list
GET /{project_id}/apigw/instances/{instance_id}/signs	apig:signatureKey:list	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/signs	apig:signatureKey:create	apig:instance:get
DELETE /{project_id}/apigw/instances/{instance_id}/signs/{sign_id}	apig:signatureKey:delete	apig:instance:get
PUT /{project_id}/apigw/instances/{instance_id}/signs/{sign_id}	apig:signatureKey:update	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials	apig:requestThrottling:listSpecial	apig:instance:get apig:requestThrottling:get
POST /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials	apig:requestThrottling:createSpecial	apig:instance:get apig:requestThrottling:get
DELETE /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials/{strategy_id}	apig:requestThrottling:deleteSpecial	apig:instance:get apig:requestThrottling:get
PUT /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials/{strategy_id}	apig:requestThrottling:updateSpecial	apig:instance:get apig:requestThrottling:get
GET /{project_id}/apigw/instances/{instance_id}/instance-tags	apig:instance:listSingleInstanceTag	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/instance-tags/action	apig:instance:batchCreateOrDeleteTag	apig:instance:get
GET /{project_id}/apigw/instance-tags	apig::listTag	apig:instance:get
POST /{project_id}/apigw/resource-instances/count	apig:instance:getNumByTags	-
POST /{project_id}/apigw/resource-instances/filter	apig:instance:listByTags	-
GET /{project_id}/apigw/instances	apig:instance:list	-
POST /{project_id}/apigw/instances	apig:instance:create	vpc:securityGroups:get vpc:ports:create vpc:ports:update eip:publicIps:get eip:publicIps:update eps:enterpriseProjects:list
DELETE /{project_id}/apigw/instances/{instance_id}	apig:instance:delete	eip:publicIps:get eip:publicIps:update vpc:ports:delete
GET /{project_id}/apigw/instances/{instance_id}	apig:instance:get	-
PUT /{project_id}/apigw/instances/{instance_id}	apig:instance:update	vpc:securityGroups:get vpc:ports:update
DELETE /{project_id}/apigw/instances/{instance_id}/eip	apig:instance:unbindEip	apig:instance:get eip:publicIps:update
PUT /{project_id}/apigw/instances/{instance_id}/eip	apig:instance:bindOrChangeEip	apig:instance:get eip:publicIps:update
DELETE /{project_id}/apigw/instances/{instance_id}/nat-eip	apig:instance:deleteOutboundEip	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/nat-eip	apig:instance:createOutboundEip	apig:instance:get vpc:ports:get
PUT /{project_id}/apigw/instances/{instance_id}/nat-eip	apig:instance:changeOutboundEipBandwidth	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/progress	apig:instance:getCreateProgress	-
DELETE /{project_id}/apigw/instances/{instance_id}/ingress-eip	apig:instance:deleteIngressEip	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/ingress-eip	apig:instance:createIngressEip	apig:instance:get
PUT /{project_id}/apigw/instances/{instance_id}/ingress-eip	apig:instance:changeIngressEipBindwidth	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/postpaid-resize	apig:instance:resize	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/restriction	apig:instance:getRestriction	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/features	apig:instance:listParameter	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/features	apig:instance:updateParameter	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/instance-features	apig:instance:listFeature	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/microservice/import	apig:instance:importMicroservice	apig:instance:get apig:api:create apig:apiGroup:get apig:apiGroup:create apig:loadBalanceChannel:get apig:loadBalanceChannel:create cce:cluster:getCluster cce:cluster:generateClientCredential
POST /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains	apig:apiGroup:bindDomain	apig:instance:get apig:apiGroup:get
DELETE /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}	apig:apiGroup:unbindDomain	apig:instance:get apig:apiGroup:get
PUT /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}	apig:apiGroup:updateDomainConfig	apig:instance:get apig:apiGroup:get
POST /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificate	apig:apiGroup:createAndBindCertificateToDomain	apig:instance:get apig:apiGroup:get apig:certificate:get
DELETE /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificate/{certificate_id}	apig:apiGroup:unbindAndDeleteCertificateFromDomain	apig:instance:get apig:apiGroup:get apig:certificate:get
GET /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificate/{certificate_id}	apig:apiGroup:getCertificateOfDomain	apig:instance:get apig:apiGroup:get apig:certificate:get
PUT /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/sl-domain-access-settings	apig:apiGroup:updateSLDomainSetting	apig:instance:get apig:apiGroup:get
GET /{project_id}/apigw/instances/{instance_id}/authorizers	apig:customAuthorizer:list	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/authorizers	apig:customAuthorizer:create	apig:instance:get functiongraph:function:getFunctionConfig
DELETE /{project_id}/apigw/instances/{instance_id}/authorizers/{authorizer_id}	apig:customAuthorizer:delete	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/authorizers/{authorizer_id}	apig:customAuthorizer:get	apig:instance:get
PUT /{project_id}/apigw/instances/{instance_id}/authorizers/{authorizer_id}	apig:customAuthorizer:update	apig:instance:get functiongraph:function:getFunctionConfig
GET /{project_id}/apigw/instances/{instance_id}/vpc-endpoint/connections	apig:instance:listVpcEndpoint	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/vpc-endpoint/connections/action	apig:instance:acceptOrRejectVpcEndpointConnection	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/vpc-endpoint/permissions	apig:instance:listVpcEndpointPermission	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/vpc-endpoint/permissions/batch-add	apig:instance:batchAddVpcEndpointPermission	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/vpc-endpoint/permissions/batch-delete	apig:instance:batchDeleteVpcEndpointPermission	apig:instance:get
DELETE /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-acl	apig:app:deleteAcl	apig:instance:get apig:app:get
GET /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-acl	apig:app:getAcl	apig:instance:get apig:app:get
PUT /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-acl	apig:app:updateAcl	apig:instance:get apig:app:get
GET /{project_id}/apigw/instances/{instance_id}/app-quotas	apig:clientQuota:list	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/app-quotas	apig:clientQuota:create	apig:instance:get
DELETE /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}	apig:clientQuota:delete	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}	apig:clientQuota:get	apig:instance:get
PUT /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}	apig:clientQuota:update	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}/bound-apps	apig:clientQuota:listBoundApp	apig:instance:get
POST /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}/binding-apps	apig:clientQuota:bindApp	apig:instance:get apig:clientQuota:get
DELETE /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}/bound-apps/{app_id}	apig:clientQuota:unbindApp	apig:instance:get apig:app:get apig:clientQuota:get
GET /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}/bindable-apps	apig:clientQuota:listUnboundApp	apig:instance:get apig:clientQuota:get
POST /{project_id}/apigw/instances/{instance_id}/custom-ingress-ports	apig:instance:addCustomIngressPort	apig:instance:get
GET /{project_id}/apigw/instances/{instance_id}/custom-ingress-ports	apig:instance:listCustomIngressPort	apig:instance:get
DELETE /{project_id}/apigw/instances/{instance_id}/custom-ingress-ports/{ingress_port_id}	apig:instance:deleteCustomIngressPort	apig:instance:get apig:instance:listCustomIngressPort
GET /{project_id}/apigw/instances/{instance_id}/custom-ingress-ports/{ingress_port_id}/domains	apig:instance:listCustomIngressPortDomain	apig:instance:get apig:apiGroup:get apig:instance:listCustomIngressPort

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for apig.

**Table 3** Resource types supported by apig
Resource Type	URN
instance	apig:<region>:<account-id>:instance:<instance-id>

Conditions

apig does not support service-specific condition keys in identity policies.It can only use global condition keys applicable to all services. For details, see Global Condition Keys.

Parent topic: Middleware

Previous topic: Distributed Message Service for RocketMQ (RocketMQ)

Next topic: Distributed Cache Service (DCS)