API Overview

Obtaining a User Token Through Password Authentication

Obtain a user token through username/password-based authentication.

Obtaining a User Token Through Password and Virtual MFA Authentication- KeystoneCreateUserTokenByPasswordAndMfa

Obtain a user token using a username, password, and virtual MFA code on condition that virtual MFA–based login protection has been enabled.

Obtaining an Agency Token - KeystoneCreateAgencyToken

Obtain an agency token.

Verifying a Token - KeystoneValidateToken

Used by the administrator to verify the token of an IAM user or used by an IAM user to verify their own token.

Obtaining Temporary Access Keys and Security Tokens of an Agency - CreateTemporaryAccessKeyByAgency

Obtain a temporary access key and security token by using an agency.

Obtaining Temporary Access Keys and Security Tokens of an IAM User - CreateTemporaryAccessKeyByToken

Obtain a temporary access key and security token using a token.

Creating a Permanent Access Key - CreatePermanentAccessKey

Used by the administrator to create a permanent access key for an IAM user or used by an IAM user to create a permanent access key.

Querying Permanent Access Keys - ListPermanentAccessKeys

Used by the administrator to query all permanent access key of an IAM user or used by an IAM user to query all of their own permanent access keys.

Querying a Permanent Access Key - ShowPermanentAccessKey

Used by the administrator to query the specified permanent access key of an IAM user or used by an IAM user to query one of their own permanent access keys.

Modifying a Permanent Access Key - UpdatePermanentAccessKey

Used by the administrator to modify the specified permanent access key of an IAM user or used by an IAM user to modify one of their own permanent access keys.

Deleting a Permanent Access Key - DeletePermanentAccessKey

Used by the administrator to delete the specified permanent access key of an IAM user or used by an IAM user to delete one of their own permanent access keys.

Listing Regions - KeystoneListRegions

Query regions.

Querying Region Details - KeystoneShowRegion

Query region details.

Querying Project Information - KeystoneListProjects

Query project information.

Listing Projects - KeystoneListProjectsForUser

Used by the administrator to list the projects accessible to a specified IAM user or used by an IAM user to list accessible projects.

Listing Projects Accessible to an IAM User - KeystoneListAuthProjects

List the projects in which resources are accessible to a specified IAM user.

Creating a Project - KeystoneCreateProject

Provided for the administrator to create a project.

Modifying Project Information - KeystoneUpdateProject

Provided for the administrator to modify project information.

Querying Project Information - KeystoneShowProject

Query the detailed information about a project based on the project ID.

Changing Project Status - UpdateProjectStatus

Provided for the administrator to change the status of a specified project. The project status can be normal or suspended.

Querying Project Information and Status - ShowProjectDetailsAndStatus

Provided for the administrator to query project details and status.

Querying the Quotas of a Project - ShowProjectQuota

Query the quotas of a specified project.

Querying Account Information Accessible to an IAM User - KeystoneListAuthDomains

Query the account information that is accessible to a specified IAM user.

Querying the Password Strength Policy - KeystoneShowSecurityCompliance

Query the password strength policy, including the regular expression and description, of a specified account.

Querying the Password Strength Policy with Conditions - KeystoneShowSecurityComplianceByOption

Query the password strength policy, including the regular expression and description, of a specified account based on specified conditions.

Querying the Quotas of an Account - ShowDomainQuota

Query the quotas of a specified account.

Listing IAM Users - KeystoneListUsers

Provided for the administrator to list all IAM users.

Querying IAM User Details (Recommended)- ShowUser

Used by the administrator to query the details about a specified IAM user or used by an IAM user to query their own details, including the mobile number and email address.

Querying IAM User Details - KeystoneShowUser

Used by the administrator to query the details about a specified IAM user or used by an IAM user to query their own details, excluding the mobile number and email address.

Querying the User Groups to Which an IAM User Belongs

Used by the administrator to query the groups of a specified IAM user or used by an IAM user to query their own groups.

Querying the IAM Users in a Group

Used by the administrator to query the IAM users in a user group.

Creating an IAM User (Recommended)- CreateUser

Provided for the administrator to create an IAM user.

Creating an IAM User

Provided for the administrator to create an IAM user.

Changing the Login Password

Used by an IAM user to change the login password.

Modifying IAM User Information (By an IAM User) (Recommended)- UpdateUserInformation

Used by an IAM user to modify its basic information.

Modifying IAM User Information (By the Administrator) (Recommended)- UpdateUser

Provided for the administrator to modify IAM user information.

Modifying IAM User Information (By the Administrator) - KeystoneUpdateUserByAdmin

Provided for the administrator to modify IAM user information.

Deleting an IAM User - KeystoneDeleteUser

Provided for the administrator to delete an IAM user.

Listing MFA Device Information of IAM Users

Provided for the administrator to query the MFA device information of IAM users.

Querying the MFA Device Information of an IAM User

Used by the administrator to query the MFA device information of a specified IAM user or used by an IAM user to query their own MFA device information.

Listing Login Protection Configurations of IAM Users

Provided for the administrator to query the login protection configurations of IAM users.

Querying the Login Protection Configuration of an IAM User

Used by the administrator to query the login protection configuration of a specified IAM user or used by an IAM user to query their own login protection configuration.

Modifying the Login Protection Configuration of an IAM User

Provided for the administrator to modify the login protection configuration of an IAM user.

Binding a Virtual MFA Device - CreateBindingDevice

Bind a virtual MFA device to an IAM user.

Unbinding a Virtual MFA Device - DeleteBindingDevice

Unbind the virtual MFA device bound to an IAM user.

Creating a Virtual MFA Device - CreateMfaDevice

Create a virtual MFA device for an IAM user.

Deleting a Virtual MFA Device - DeleteMfaDevice

Provided for the administrator to delete the virtual MFA device created for an IAM user.

Listing User Groups - KeystoneListGroups

Provided for the administrator to list all user groups.

Querying User Group Details - KeystoneShowGroup

Provided for the administrator to query user group information.

Creating a User Group - KeystoneCreateGroup

Provided for the administrator to create a user group.

Updating User Group Information - KeystoneUpdateGroup

Provided for the administrator to update user group information.

Deleting a User Group - KeystoneDeleteGroup

Provided for the administrator to delete a user group.

Checking Whether an IAM User Belongs to a User Group - KeystoneCheckUserInGroup

Provided for the administrator to check whether an IAM user belongs to a specified user group.

Adding an IAM User to a User Group - KeystoneAddUserToGroup

Provided for the administrator to add an IAM user to a specified user group.

Removing an IAM User from a User Group - KeystoneRemoveUserFromGroup

Used by the administrator to remove an IAM user from a specified user group.

Listing Permissions - KeystoneListPermissions

Provided for the administrator to list all permissions.

Querying Permission Details - KeystoneShowPermission

Provided for the administrator to query permission details.

Querying Permissions of a User Group for a Global Service Project

Provided for the administrator to query the permissions of a user group for the global service project.

Querying Permissions of a User Group for a Region-specific Project

Provided for the administrator to query the permissions of a user group for a region-specific project.

Granting Permissions to a User Group for a Global Service Project - KeystoneAssociateGroupWithDomainPermission

Provided for the administrator to grant permissions to a user group for the global service project.

Granting Permissions to a User Group for a Region-specific Project - KeystoneAssociateGroupWithProjectPermission

Provided for the administrator to grant permissions to a user group for a region-specific project.

Checking Whether a User Group Has Specified Permissions for a Global Service Project - KeystoneCheckDomainPermissionForGroup

Provided for the administrator to check whether a user group has specified permissions for the global service project.

Checking Whether a User Group Has Specified Permissions for a Region-specific Project - KeystoneCheckProjectPermissionForGroup

Provided for the administrator to check whether a user group has specified permissions for a region-specific project.

Querying All Permissions of a User Group - KeystoneListAllProjectPermissionsForGroup

Provided for the administrator to query all permissions that have been assigned to a user group.

Checking Whether a User Group Has Specified Permissions for All Projects - KeystoneCheckroleForGroup

Provided for the administrator to check whether a user group has specified permissions for all projects.

Removing Specified Permissions of a User Group in All Projects - DeleteDomainGroupInheritedRole

Provided for the administrator to remove the specified permissions of a user group for all projects.

Removing Permissions of a User Group for a Global Service Project - KeystoneRemoveDomainPermissionFromGroup

Provided for the administrator to remove the specified permissions of a user group for the global service project.

Removing the Permissions of a User Group for a Region-specific Project - KeystoneRemoveProjectPermissionFromGroup

Provided for the administrator to remove the specified permissions of a user group for a region-specific project.

Granting Permissions to a User Group for All Projects - UpdateDomainGroupInheritRole

Provided for the administrator to grant permissions to a user group for all projects.

Listing Custom Policies - ListCustomPolicies

Provided for the administrator to list all custom policies.

Querying Custom Policy Details - ShowCustomPolicy

Provided for the administrator to query the details of a specified custom policy.

Creating a Custom Policy for Cloud Services - CreateCloudServiceCustomPolicy

Provided for the administrator to create a custom policy for cloud services.

Creating a Custom Policy for Agencies - CreateAgencyCustomPolicy

Provided for the administrator to create a custom policy for agencies.

Modifying a Custom Policy for Cloud Services - UpdateCloudServiceCustomPolicy

Provided for the administrator to modify a custom policy for cloud services.

Modifying a Custom Policy for Agencies - UpdateAgencyCustomPolicy

Provided for the administrator to modify a custom policy for agencies.

Deleting a Custom Policy - DeleteCustomPolicy

Provided for the administrator to delete a custom policy.

Listing Agencies - ListAgencies

Provided for the administrator to list agencies that match specified conditions.

Querying Agency Details - ShowAgency

Provided for the administrator to query the details about an agency.

Creating an Agency - CreateAgency

Provided for the administrator to create an agency.

Modifying an Agency - UpdateAgency

Provided for the administrator to modify an agency.

Deleting an Agency - DeleteAgency

Provided for the administrator to delete an agency.

Querying Permissions of an Agency for a Global Service Project - ListDomainPermissionsForAgency

Provided for the administrator to query the permissions of an agency for the global service project.

Querying Permissions of an Agency for a Region-specific Project - ListProjectPermissionsForAgency

Provided for the administrator to query the permissions of an agency for a region-specific project.

Granting Permissions to an Agency for a Global Service Project - AssociateAgencyWithDomainPermission

Provided for the administrator to grant permissions to an agency for the global service project.

Granting Permissions to an Agency for a Region-specific Project - AssociateAgencyWithProjectPermission

Provided for the administrator to grant permissions to an agency for a region-specific project.

Checking Whether an Agency Has Specified Permissions for a Global Service Project - CheckDomainPermissionForAgency

Provided for the administrator to check whether an agency has specified permissions for the global service project.

Checking Whether an Agency Has Specified Permissions for a Region-specific Project - CheckProjectPermissionForAgency

Provided for the administrator to check whether an agency has specified permissions for a region-specific project.

Removing Permissions of an Agency for a Global Service Project - RemoveDomainPermissionFromAgency

Provided for the administrator to remove the specified permissions of an agency for the global service project.

Removing Permissions of an Agency for a Region-specific Project - RemoveProjectPermissionFromAgency

Provided for the administrator to remove the specified permissions of an agency for a region-specific project.

Querying All Project Permissions of an Agency - ListAllProjectsPermissionsForAgency

Provided for the administrator to query all permissions that have been assigned to an agency.

Granting Specified Permissions to an Agency for All Projects - AssociateAgencyWithAllProjectsPermission

Provided for the administrator to grant specified permissions to an agency for all projects.

Checking Whether an Agency Has All Project Permissions - CheckAllProjectsPermissionForAgency

Provided for the administrator to check whether an agency has specified permissions.

Removing Specified Permissions of an Agency in All Projects - RemoveAllProjectsPermissionFromAgency

Provided for the administrator to remove the specified permissions of an agency in all projects.

Querying User Groups Associated with an Enterprise Project - ListGroupsForEnterpriseProject

Query the user groups associated with the enterprise project of a specified ID.

Querying the Permissions of a User Group Associated with an Enterprise Project - ListRolesForGroupOnEnterpriseProject

Query the permissions of a user group associated with the enterprise project of a specified ID.

Granting Permissions to a User Group Associated with an Enterprise Project - AssociateRoleToGroupOnEnterpriseProject

Grant permissions to a user group associated with the enterprise project of a specified ID.

Removing Permissions of a User Group Associated with an Enterprise Project - RevokeRoleFromGroupOnEnterpriseProject

Remove the permissions of a user group associated with an enterprise project.

Querying the Enterprise Projects Associated with a User Group - ListEnterpriseProjectsForGroup

Query the enterprise projects associated with a user group.

Querying the Enterprise Projects Directly Associated with an IAM User - ListEnterpriseProjectsForUser

Query the enterprise projects associated with an IAM user.

Querying Users Directly Associated with an Enterprise Project - ListUsersForEnterpriseProject

Query the users directly associated with a specified enterprise project.

Querying Permissions of a User Directly Associated with an Enterprise Project - ListRolesForUserOnEnterpriseProject

Query the permissions of a user directly associated with a specified enterprise project.

Granting Permissions to a User Associated with an Enterprise Project - AssociateRoleToUserOnEnterpriseProject

Grant permissions to a user for an enterprise project.

Removing Permissions of a User Directly Associated with an Enterprise Project

Remove the permissions of a user directly associated with a specified enterprise project.

Modifying the Operation Protection Policy - UpdateDomainProtectPolicy

Provided for the administrator to modify the operation protection policy.

Querying the Operation Protection Policy - ShowDomainProtectPolicy

Query the operation protection policy.

Modifying the Password Policy - UpdateDomainPasswordPolicy

Provided for the administrator to modify the password policy.

Querying the Password Policy of an Account - ShowDomainPasswordPolicy

Query the password policy.

Modifying the Login Authentication Policy - UpdateDomainLoginPolicy

Provided for the administrator to modify the login authentication policy.

Querying the Login Authentication Policy - ShowDomainLoginPolicy

Query the login authentication policy.

Modifying the ACL for Console Access - UpdateDomainConsoleAclPolicy

Provided for the administrator to modify the ACL for console access.

Querying the ACL for Console Access - ShowDomainConsoleAclPolicy

Query the ACL for console access.

Modifying the ACL for API Access - UpdateDomainApiAclPolicy

Provided for the administrator to modify the ACL for API access.

Querying the ACL for API Access - ShowDomainApiAclPolicy

Query the ACL for API access.

SP Initiated

Obtain a federated authentication token using the OpenStack Client or ShibbolethECP Client.

IdP Initiated

Obtain a federated authentication token in the IdP-initiated mode. The Client4ShibbolethIdP script is used as an example.

Listing Identity Providers - KeystoneListIdentityProviders

List all identity providers.

Querying Identity Provider Details - KeystoneShowIdentityProvider

Query the details about an identity provider.

Creating an Identity Provider - KeystoneCreateIdentityProvider

Provided for the administrator to register an identity provider.

Modifying a SAML Identity Provider - KeystoneUpdateIdentityProvider

Provided for the administrator to update an identity provider.

Deleting a SAML Identity Provider - KeystoneDeleteIdentityProvider

Provided for the administrator to delete an identity provider.

Listing Mappings - KeystoneListMappings

List all mappings.

Querying Mapping Details - KeystoneShowMapping

Query the details of a mapping.

Registering a Mapping - KeystoneCreateMapping

Provided for the administrator to register a mapping.

Updating a Mapping - KeystoneUpdateMapping

Provided for the administrator to update a mapping.

Deleting a Mapping - KeystoneDeleteMapping

Provided for the administrator to delete a mapping.

Listing Protocols - KeystoneListProtocols

List all protocols.

Querying Protocol Details - KeystoneShowProtocol

Query the details of a protocol.

Registering a Protocol - KeystoneCreateProtocol

Provided for the administrator to register a protocol, that is, to associate a protocol with an identity provider.

Updating a Protocol - KeystoneUpdateProtocol

Provided for the administrator to update the protocol associated with a specified identity provider.

Deleting a Protocol - KeystoneDeleteProtocol

Provided for the administrator to delete the protocol associated with a specified identity provider.

Querying a Metadata File - ShowMetadata

Provided for the administrator to query the metadata file imported to IAM for an identity provider.

Querying the Metadata File of Keystone - ShowKeystoneMetadataFile

Query the metadata file of Keystone.

Importing a Metadata File - CreateMetadata

Provided for the administrator to import a metadata file.

Obtaining an Unscoped Token (IdP Initiated)

Obtain an unscoped token through IdP-initiated federated identity authentication.

Obtaining a Scoped Token

This API is used to obtain a scoped token through federated identity authentication.

Obtaining a Token with an OpenID Connect ID Token - CreateTokenWithIdToken

Obtain a federated identity authentication token using an OpenID Connect ID token.

Obtaining an Unscoped Token with an OpenID Connect ID Token - CreateUnscopedTokenWithIdToken

Obtain an unscoped token using an OpenID Connect ID token.

Listing Accounts Accessible to Federated Users - KeystoneListFederationDomains

List the accounts whose resources are accessible to federated users.

Obtaining a Login Token - CreateLoginToken

Obtain a token for logging in through a custom identity broker.

Querying the Version Information of Keystone APIs - KeystoneListVersions

Query the version information of Keystone APIs.

Querying Information About Keystone API 3.0 - KeystoneShowVersion

Obtain the information about Keystone API 3.0.

Listing Services - KeystoneListServices

List all services.

Querying Service Details - KeystoneShowService

Query the details of a service.

Querying the Service Catalog - KeystoneShowCatalog

Query the service catalog corresponding to X-Auth-Token contained in the request.

Listing Endpoints - KeystoneListEndpoints

List all endpoints.

Querying Endpoint Details - KeystoneShowEndpoint

Query the details of an endpoint.