openapi: 3.0.0
info:
  version: 2015-07-09
  x-release: v4
  title: APIs.io Engineering Platform Amazon API Gateway 2014 11 13 Access Reusable Policies API
  description: <fullname>Amazon API Gateway</fullname> <p>Amazon API Gateway helps developers deliver robust, secure, and scalable mobile and web application back ends. API Gateway allows developers to securely connect mobile and web applications to APIs that run on AWS Lambda, Amazon EC2, or other publicly addressable web services that are hosted outside of AWS.</p>
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_twitter.com_awscloud_profile_image.png
    backgroundColor: '#FFFFFF'
  termsOfService: https://aws.amazon.com/service-terms/
  contact:
    name: Mike Ralphson
    email: mike.ralphson@gmail.com
    url: https://github.com/mermade/aws2openapi
    x-twitter: PermittedSoc
  license:
    name: Apache 2.0 License
    url: http://www.apache.org/licenses/
  x-providerName: amazonaws.com
  x-serviceName: apigateway
  x-origin:
  - contentType: application/json
    url: https://raw.githubusercontent.com/aws/aws-sdk-js/master/apis/apigateway-2015-07-09.normal.json
    converter:
      url: https://github.com/mermade/aws2openapi
      version: 1.0.0
    x-apisguru-driver: external
  x-apiClientRegistration:
    url: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct
  x-apisguru-categories:
  - cloud
  x-preferred: true
servers:
- url: http://apigateway.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Amazon API Gateway multi-region endpoint
- url: https://apigateway.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Amazon API Gateway multi-region endpoint
- url: http://apigateway.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Amazon API Gateway endpoint for China (Beijing) and China (Ningxia)
- url: https://apigateway.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Amazon API Gateway endpoint for China (Beijing) and China (Ningxia)
security:
- hmac: []
tags:
- name: Access Reusable Policies
paths:
  /accounts/{account_id}/access/policies:
    get:
      description: Lists Access reusable policies.
      operationId: access-policies-list-access-reusable-policies
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: List Access reusable policies response failure.
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_reusable-policies_components-schemas-response_collection'
          description: List Access reusable policies response.
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform List Access reusable policies
      tags:
      - Access Reusable Policies
      x-api-token-group:
      - 'Access: Apps and Policies Write'
      - 'Access: Apps and Policies Read'
    post:
      description: Creates a new Access reusable policy.
      operationId: access-policies-create-an-access-reusable-policy
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/access_policy_req'
        required: true
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Create an Access reusable policy response failure.
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_reusable-policies_components-schemas-single_response'
          description: Create an Access reusable policy response.
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Create an Access reusable policy
      tags:
      - Access Reusable Policies
      x-api-token-group:
      - 'Access: Apps and Policies Write'
  /accounts/{account_id}/access/policies/{policy_id}:
    delete:
      description: Deletes an Access reusable policy.
      operationId: access-policies-delete-an-access-reusable-policy
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      - in: path
        name: policy_id
        required: true
        schema:
          $ref: '#/components/schemas/access_schemas-uuid'
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Delete an Access reusable policy response failure.
        '202':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_reusable-policies_components-schemas-id_response'
          description: Delete an Access reusable policy response.
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Delete an Access reusable policy
      tags:
      - Access Reusable Policies
      x-api-token-group:
      - 'Access: Apps and Policies Write'
    get:
      description: Fetches a single Access reusable policy.
      operationId: access-policies-get-an-access-reusable-policy
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      - in: path
        name: policy_id
        required: true
        schema:
          $ref: '#/components/schemas/access_schemas-uuid'
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Get an Access reusable policy response failure.
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_reusable-policies_components-schemas-single_response'
          description: Get an Access reusable policy response.
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Get an Access reusable policy
      tags:
      - Access Reusable Policies
      x-api-token-group:
      - 'Access: Apps and Policies Write'
      - 'Access: Apps and Policies Read'
    put:
      description: Updates a Access reusable policy.
      operationId: access-policies-update-an-access-reusable-policy
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      - in: path
        name: policy_id
        required: true
        schema:
          $ref: '#/components/schemas/access_schemas-uuid'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/access_policy_req'
        required: true
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Update an Access reusable policy response failure.
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_reusable-policies_components-schemas-single_response'
          description: Update an Access reusable policy response.
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Update an Access reusable policy
      tags:
      - Access Reusable Policies
      x-api-token-group:
      - 'Access: Apps and Policies Write'
components:
  schemas:
    access_approval_groups:
      description: Administrators who can approve a temporary authentication request.
      example:
      - approvals_needed: 1
        email_addresses:
        - test1@cloudflare.com
        - test2@cloudflare.com
      - approvals_needed: 3
        email_list_uuid: 597147a1-976b-4ef2-9af0-81d5d007fc34
      items:
        $ref: '#/components/schemas/access_approval_group'
      type: array
    access_schemas-require:
      description: Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
      items:
        $ref: '#/components/schemas/access_rule'
      type: array
    access_any_valid_service_token_rule:
      description: Matches any valid Access Service Token
      properties:
        any_valid_service_token:
          description: An empty object which matches on all service tokens.
          example: {}
          type: object
      required:
      - any_valid_service_token
      title: Any Valid Service Token
      type: object
    access_service_token_rule:
      description: Matches a specific Access Service Token
      properties:
        service_token:
          properties:
            token_id:
              description: The ID of a Service Token.
              example: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
              type: string
          required:
          - token_id
          type: object
      required:
      - service_token
      title: Service Token
      type: object
    access_api-response-collection:
      allOf:
      - $ref: '#/components/schemas/access_api-response-common'
      - properties:
          result_info:
            $ref: '#/components/schemas/access_result_info'
      type: object
    access_policy_components-schemas-name:
      description: The name of the Access policy.
      example: Allow devs
      type: string
    access_rule:
      oneOf:
      - $ref: '#/components/schemas/access_email_rule'
      - $ref: '#/components/schemas/access_email_list_rule'
      - $ref: '#/components/schemas/access_domain_rule'
      - $ref: '#/components/schemas/access_everyone_rule'
      - $ref: '#/components/schemas/access_ip_rule'
      - $ref: '#/components/schemas/access_ip_list_rule'
      - $ref: '#/components/schemas/access_certificate_rule'
      - $ref: '#/components/schemas/access_access_group_rule'
      - $ref: '#/components/schemas/access_azure_group_rule'
      - $ref: '#/components/schemas/access_github_organization_rule'
      - $ref: '#/components/schemas/access_gsuite_group_rule'
      - $ref: '#/components/schemas/access_okta_group_rule'
      - $ref: '#/components/schemas/access_saml_group_rule'
      - $ref: '#/components/schemas/access_service_token_rule'
      - $ref: '#/components/schemas/access_any_valid_service_token_rule'
      - $ref: '#/components/schemas/access_external_evaluation_rule'
      - $ref: '#/components/schemas/access_country_rule'
      - $ref: '#/components/schemas/access_authentication_method_rule'
      - $ref: '#/components/schemas/access_device_posture_rule'
      type: object
    access_github_organization_rule:
      description: 'Matches a Github organization.

        Requires a Github identity provider.'
      properties:
        github-organization:
          properties:
            identity_provider_id:
              description: The ID of your Github identity provider.
              example: ea85612a-29c8-46c2-bacb-669d65136971
              type: string
            name:
              description: The name of the organization.
              example: cloudflare
              type: string
          required:
          - name
          - identity_provider_id
          type: object
      required:
      - github-organization
      title: Github organization
      type: object
    access_authentication_method_rule:
      description: Enforce different MFA options
      properties:
        auth_method:
          properties:
            auth_method:
              description: The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
              example: mfa
              type: string
          required:
          - auth_method
          type: object
      required:
      - auth_method
      title: Authentication method
      type: object
    access_identifier:
      description: Identifier
      example: 023e105f4ecef8ad9ca31a8372d0c353
      maxLength: 32
      type: string
    access_saml_group_rule:
      description: 'Matches a SAML group.

        Requires a SAML identity provider.'
      properties:
        saml:
          properties:
            attribute_name:
              description: The name of the SAML attribute.
              example: group
              type: string
            attribute_value:
              description: The SAML attribute value to look for.
              example: devs@cloudflare.com
              type: string
            identity_provider_id:
              description: The ID of your SAML identity provider.
              example: ea85612a-29c8-46c2-bacb-669d65136971
              type: string
          required:
          - attribute_name
          - attribute_value
          - identity_provider_id
          type: object
      required:
      - saml
      title: SAML group
      type: object
    access_access_group_rule:
      description: Matches an Access group.
      properties:
        group:
          properties:
            id:
              description: The ID of a previously created Access group.
              example: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
              type: string
          required:
          - id
          type: object
      required:
      - group
      title: Access groups
      type: object
    access_country_rule:
      description: Matches a specific country
      properties:
        geo:
          properties:
            country_code:
              description: The country code that should be matched.
              example: US
              type: string
          required:
          - country_code
          type: object
      required:
      - geo
      title: Country
      type: object
    access_result_info:
      properties:
        count:
          description: Total number of results for the requested service
          example: 1
          type: number
        page:
          description: Current page within paginated list of results
          example: 1
          type: number
        per_page:
          description: Number of results per page of results
          example: 20
          type: number
        total_count:
          description: Total results available without any search parameters
          example: 2000
          type: number
      type: object
    access_api-response-common-failure:
      properties:
        errors:
          allOf:
          - $ref: '#/components/schemas/access_messages'
          example:
          - code: 7003
            message: No route for the URI
          minLength: 1
        messages:
          allOf:
          - $ref: '#/components/schemas/access_messages'
          example: []
        result:
          enum:
          - null
          nullable: true
          type: object
        success:
          description: Whether the API call was successful
          enum:
          - false
          example: false
          type: boolean
      required:
      - success
      - errors
      - messages
      - result
      type: object
    access_ip_list_rule:
      description: Matches an IP address from a list.
      properties:
        ip_list:
          properties:
            id:
              description: The ID of a previously created IP list.
              example: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
              type: string
          required:
          - id
          type: object
      required:
      - ip_list
      title: IP list
      type: object
    access_approval_required:
      default: false
      description: Requires the user to request access from an administrator at the start of each session.
      example: true
      type: boolean
    access_policy_resp:
      properties:
        approval_groups:
          $ref: '#/components/schemas/access_approval_groups'
        approval_required:
          $ref: '#/components/schemas/access_approval_required'
        created_at:
          $ref: '#/components/schemas/access_timestamp'
        decision:
          $ref: '#/components/schemas/access_decision'
        exclude:
          $ref: '#/components/schemas/access_schemas-exclude'
        id:
          $ref: '#/components/schemas/access_schemas-uuid'
        include:
          $ref: '#/components/schemas/access_include'
        isolation_required:
          $ref: '#/components/schemas/access_isolation_required'
        name:
          $ref: '#/components/schemas/access_policy_components-schemas-name'
        purpose_justification_prompt:
          $ref: '#/components/schemas/access_purpose_justification_prompt'
        purpose_justification_required:
          $ref: '#/components/schemas/access_purpose_justification_required'
        require:
          $ref: '#/components/schemas/access_schemas-require'
        session_duration:
          $ref: '#/components/schemas/access_components-schemas-session_duration'
        updated_at:
          $ref: '#/components/schemas/access_timestamp'
      type: object
    access_ip_rule:
      description: Matches an IP address block.
      properties:
        ip:
          properties:
            ip:
              description: An IPv4 or IPv6 CIDR block.
              example: 2400:cb00:21:10a::/64
              type: string
          required:
          - ip
          type: object
      required:
      - ip
      title: IP ranges
      type: object
    access_purpose_justification_required:
      default: false
      description: Require users to enter a justification when they log in to the application.
      example: true
      type: boolean
    access_gsuite_group_rule:
      description: 'Matches a group in Google Workspace.

        Requires a Google Workspace identity provider.'
      properties:
        gsuite:
          properties:
            email:
              description: The email of the Google Workspace group.
              example: devs@cloudflare.com
              type: string
            identity_provider_id:
              description: The ID of your Google Workspace identity provider.
              example: ea85612a-29c8-46c2-bacb-669d65136971
              type: string
          required:
          - email
          - identity_provider_id
          type: object
      required:
      - gsuite
      title: Google Workspace group
      type: object
    access_isolation_required:
      default: false
      description: Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
      example: false
      type: boolean
    access_reusable-policies_components-schemas-single_response:
      allOf:
      - $ref: '#/components/schemas/access_api-response-single'
      - properties:
          result:
            $ref: '#/components/schemas/access_reusable_policy_resp'
    access_reusable-policies_components-schemas-response_collection:
      allOf:
      - $ref: '#/components/schemas/access_api-response-collection'
      - properties:
          result:
            items:
              $ref: '#/components/schemas/access_reusable_policy_resp'
            type: array
    access_reusable_policy_resp:
      allOf:
      - $ref: '#/components/schemas/access_policy_resp'
      - properties:
          app_count:
            $ref: '#/components/schemas/access_app_count'
          reusable:
            enum:
            - true
            type: boolean
    access_okta_group_rule:
      description: 'Matches an Okta group.

        Requires an Okta identity provider.'
      properties:
        okta:
          properties:
            identity_provider_id:
              description: The ID of your Okta identity provider.
              example: ea85612a-29c8-46c2-bacb-669d65136971
              type: string
            name:
              description: The name of the Okta group.
              example: devs
              type: string
          required:
          - name
          - identity_provider_id
          type: object
      required:
      - okta
      title: Okta group
      type: object
    access_api-response-common:
      properties:
        errors:
          $ref: '#/components/schemas/access_messages'
        messages:
          $ref: '#/components/schemas/access_messages'
        success:
          description: Whether the API call was successful
          enum:
          - true
          example: true
          type: boolean
      required:
      - success
      - errors
      - messages
      type: object
    access_domain_rule:
      description: Match an entire email domain.
      properties:
        email_domain:
          properties:
            domain:
              description: The email domain to match.
              example: example.com
              type: string
          required:
          - domain
          type: object
      required:
      - email_domain
      title: Email domain
      type: object
    access_email_rule:
      description: Matches a specific email.
      properties:
        email:
          properties:
            email:
              description: The email of the user.
              example: test@example.com
              format: email
              type: string
          required:
          - email
          type: object
      required:
      - email
      title: Email
      type: object
    access_external_evaluation_rule:
      description: Create Allow or Block policies which evaluate the user based on custom criteria.
      properties:
        external_evaluation:
          properties:
            evaluate_url:
              description: The API endpoint containing your business logic.
              example: https://eval.example.com
              type: string
            keys_url:
              description: The API endpoint containing the key that Access uses to verify that the response came from your API.
              example: https://eval.example.com/keys
              type: string
          required:
          - evaluate_url
          - keys_url
          type: object
      required:
      - external_evaluation
      title: External Evaluation
      type: object
    access_components-schemas-session_duration:
      default: 24h
      description: 'The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.'
      example: 24h
      type: string
    access_messages:
      example: []
      items:
        properties:
          code:
            minimum: 1000
            type: integer
          message:
            type: string
        required:
        - code
        - message
        type: object
        uniqueItems: true
      type: array
    access_reusable-policies_components-schemas-id_response:
      allOf:
      - $ref: '#/components/schemas/access_api-response-single'
      - properties:
          result:
            properties:
              id:
                $ref: '#/components/schemas/access_schemas-uuid'
            type: object
    access_device_posture_rule:
      description: Enforces a device posture rule has run successfully
      properties:
        device_posture:
          properties:
            integration_uid:
              description: The ID of a device posture integration.
              example: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
              type: string
          required:
          - integration_uid
          type: object
      required:
      - device_posture
      title: Device Posture
      type: object
    access_schemas-exclude:
      description: Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
      items:
        $ref: '#/components/schemas/access_rule'
      type: array
    access_decision:
      description: The action Access will take if a user matches this policy.
      enum:
      - allow
      - deny
      - non_identity
      - bypass
      example: allow
      type: string
    access_timestamp:
      example: '2014-01-01T05:20:00.12345Z'
      format: date-time
      type: string
    access_everyone_rule:
      description: Matches everyone.
      properties:
        everyone:
          description: An empty object which matches on all users.
          example: {}
          type: object
      required:
      - everyone
      title: Everyone
      type: object
    access_email_list_rule:
      description: Matches an email address from a list.
      properties:
        email_list:
          properties:
            id:
              description: The ID of a previously created email list.
              example: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
              type: string
          required:
          - id
          type: object
      required:
      - email_list
      title: Email list
      type: object
    access_approval_group:
      description: A group of email addresses that can approve a temporary authentication request.
      properties:
        approvals_needed:
          description: The number of approvals needed to obtain access.
          example: 1
          minimum: 0
          type: number
        email_addresses:
          description: A list of emails that can approve the access request.
          example:
          - test@cloudflare.com
          - test2@cloudflare.com
          items:
            type: string
          type: array
        email_list_uuid:
          description: The UUID of an re-usable email list.
          type: string
      required:
      - approvals_needed
      type: object
    access_app_count:
      description: Number of access applications currently using this policy.
      example: 2
      type: integer
    access_purpose_justification_prompt:
      description: A custom message that will appear on the purpose justification screen.
      example: Please enter a justification for entering this protected domain.
      type: string
    access_azure_group_rule:
      description: 'Matches an Azure group.

        Requires an Azure identity provider.'
      properties:
        azureAD:
          properties:
            id:
              description: The ID of an Azure group.
              example: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
              type: string
            identity_provider_id:
              description: The ID of your Azure identity provider.
              example: ea85612a-29c8-46c2-bacb-669d65136971
              type: string
          required:
          - id
          - identity_provider_id
          type: object
      required:
      - azureAD
      title: Azure group
      type: object
    access_certificate_rule:
      description: Matches any valid client certificate.
      example:
        certificate: {}
      properties:
        certificate:
          example: {}
          type: object
      required:
      - certificate
      title: Valid certificate
      type: object
    access_schemas-uuid:
      description: The UUID of the policy
      example: f174e90a-fafe-4643-bbbc-4a0ed4fc8415
      maxLength: 36
      type: string
    access_policy_req:
      properties:
        approval_groups:
          $ref: '#/components/schemas/access_approval_groups'
        approval_required:
          $ref: '#/components/schemas/access_approval_required'
        decision:
          $ref: '#/components/schemas/access_decision'
        exclude:
          $ref: '#/components/schemas/access_schemas-exclude'
        include:
          $ref: '#/components/schemas/access_include'
        isolation_required:
          $ref: '#/components/schemas/access_isolation_required'
        name:
          $ref: '#/components/schemas/access_policy_components-schemas-name'
        purpose_justification_prompt:
          $ref: '#/components/schemas/access_purpose_justification_prompt'
        purpose_justification_required:
          $ref: '#/components/schemas/access_purpose_justification_required'
        require:
          $ref: '#/components/schemas/access_schemas-require'
        session_duration:
          $ref: '#/components/schemas/access_components-schemas-session_duration'
      required:
      - name
      - decision
      - include
      type: object
    access_api-response-single:
      allOf:
      - $ref: '#/components/schemas/access_api-response-common'
      type: object
    access_include:
      description: Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
      items:
        $ref: '#/components/schemas/access_rule'
      type: array
  securitySchemes:
    hmac:
      type: apiKey
      name: Authorization
      in: header
      description: Amazon Signature authorization v4
      x-amazon-apigateway-authtype: awsSigv4
externalDocs:
  description: Amazon Web Services documentation
  url: https://docs.aws.amazon.com/apigateway/
x-hasEquivalentPaths: true