openapi: 3.0.0
info:
  version: 2015-07-09
  x-release: v4
  title: APIs.io Engineering Platform Amazon API Gateway 2014 11 13 Zero Trust Organization API
  description: <fullname>Amazon API Gateway</fullname> <p>Amazon API Gateway helps developers deliver robust, secure, and scalable mobile and web application back ends. API Gateway allows developers to securely connect mobile and web applications to APIs that run on AWS Lambda, Amazon EC2, or other publicly addressable web services that are hosted outside of AWS.</p>
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_twitter.com_awscloud_profile_image.png
    backgroundColor: '#FFFFFF'
  termsOfService: https://aws.amazon.com/service-terms/
  contact:
    name: Mike Ralphson
    email: mike.ralphson@gmail.com
    url: https://github.com/mermade/aws2openapi
    x-twitter: PermittedSoc
  license:
    name: Apache 2.0 License
    url: http://www.apache.org/licenses/
  x-providerName: amazonaws.com
  x-serviceName: apigateway
  x-origin:
  - contentType: application/json
    url: https://raw.githubusercontent.com/aws/aws-sdk-js/master/apis/apigateway-2015-07-09.normal.json
    converter:
      url: https://github.com/mermade/aws2openapi
      version: 1.0.0
    x-apisguru-driver: external
  x-apiClientRegistration:
    url: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct
  x-apisguru-categories:
  - cloud
  x-preferred: true
servers:
- url: http://apigateway.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Amazon API Gateway multi-region endpoint
- url: https://apigateway.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Amazon API Gateway multi-region endpoint
- url: http://apigateway.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Amazon API Gateway endpoint for China (Beijing) and China (Ningxia)
- url: https://apigateway.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Amazon API Gateway endpoint for China (Beijing) and China (Ningxia)
security:
- hmac: []
tags:
- name: Zero Trust Organization
paths:
  /accounts/{account_id}/access/organizations:
    get:
      description: Returns the configuration for your Zero Trust organization.
      operationId: zero-trust-organization-get-your-zero-trust-organization
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Get your Zero Trust organization response failure
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_single_response'
          description: Get your Zero Trust organization response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Get your Zero Trust organization
      tags:
      - Zero Trust Organization
      x-api-token-group:
      - 'Access: Organizations, Identity Providers, and Groups Revoke'
      - 'Access: Organizations, Identity Providers, and Groups Write'
      - 'Access: Organizations, Identity Providers, and Groups Read'
    post:
      description: Sets up a Zero Trust organization for your account.
      operationId: zero-trust-organization-create-your-zero-trust-organization
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      requestBody:
        content:
          application/json:
            schema:
              properties:
                allow_authenticate_via_warp:
                  $ref: '#/components/schemas/access_allow_authenticate_via_warp'
                auth_domain:
                  $ref: '#/components/schemas/access_auth_domain'
                auto_redirect_to_identity:
                  $ref: '#/components/schemas/access_auto_redirect_to_identity'
                is_ui_read_only:
                  $ref: '#/components/schemas/access_is_ui_read_only'
                login_design:
                  $ref: '#/components/schemas/access_login_design'
                name:
                  $ref: '#/components/schemas/access_name'
                session_duration:
                  $ref: '#/components/schemas/access_session_duration'
                ui_read_only_toggle_reason:
                  $ref: '#/components/schemas/access_ui_read_only_toggle_reason'
                user_seat_expiration_inactive_time:
                  $ref: '#/components/schemas/access_user_seat_expiration_inactive_time'
                warp_auth_session_duration:
                  $ref: '#/components/schemas/access_warp_auth_session_duration'
              required:
              - name
              - auth_domain
        required: true
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Create your Zero Trust organization response failure
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_single_response'
          description: Create your Zero Trust organization response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Create your Zero Trust organization
      tags:
      - Zero Trust Organization
      x-api-token-group:
      - 'Access: Organizations, Identity Providers, and Groups Write'
    put:
      description: Updates the configuration for your Zero Trust organization.
      operationId: zero-trust-organization-update-your-zero-trust-organization
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      requestBody:
        content:
          application/json:
            schema:
              properties:
                allow_authenticate_via_warp:
                  $ref: '#/components/schemas/access_allow_authenticate_via_warp'
                auth_domain:
                  $ref: '#/components/schemas/access_auth_domain'
                auto_redirect_to_identity:
                  $ref: '#/components/schemas/access_auto_redirect_to_identity'
                custom_pages:
                  $ref: '#/components/schemas/access_custom_pages'
                is_ui_read_only:
                  $ref: '#/components/schemas/access_is_ui_read_only'
                login_design:
                  $ref: '#/components/schemas/access_login_design'
                name:
                  $ref: '#/components/schemas/access_name'
                session_duration:
                  $ref: '#/components/schemas/access_session_duration'
                ui_read_only_toggle_reason:
                  $ref: '#/components/schemas/access_ui_read_only_toggle_reason'
                user_seat_expiration_inactive_time:
                  $ref: '#/components/schemas/access_user_seat_expiration_inactive_time'
                warp_auth_session_duration:
                  $ref: '#/components/schemas/access_warp_auth_session_duration'
        required: true
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Update your Zero Trust organization response failure
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_single_response'
          description: Update your Zero Trust organization response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Update your Zero Trust organization
      tags:
      - Zero Trust Organization
      x-api-token-group:
      - 'Access: Organizations, Identity Providers, and Groups Write'
  /accounts/{account_id}/access/organizations/doh:
    get:
      description: Returns the DoH settings for your Zero Trust organization.
      operationId: zero-trust-organization-get-your-zero-trust-organization-doh-settings
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Get your Zero Trust organization DoH settings response failure
        '200':
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/access_schemas-single_response'
                - properties:
                    result:
                      properties:
                        jwt_duration:
                          description: 'The duration the DoH JWT is valid for. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.  Note that the maximum duration for this setting is the same as the key rotation period on the account.'
                          example: 800h
                          type: string
          description: Get your Zero Trust organization DoH settings response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Get your Zero Trust organization DoH settings
      tags:
      - Zero Trust Organization
    put:
      description: Updates the DoH settings for your Zero Trust organization.
      operationId: zero-trust-organization-update-your-zero-trust-organization-doh-settings
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      requestBody:
        content:
          application/json:
            schema:
              properties:
                jwt_duration:
                  $ref: '#/components/schemas/access_doh_jwt_duration'
                service_token_id:
                  description: The uuid of the service token you want to use for DoH authentication
                  example: f174e90a-fafe-4643-bbbc-4a0ed4fc8415
                  type: string
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Update your Zero Trust organization DoH settings response failure
        '201':
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/access_schemas-single_response'
                - properties:
                    result:
                      properties:
                        jwt_duration:
                          $ref: '#/components/schemas/access_doh_jwt_duration'
          description: Update your Zero Trust organization DoH settings response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Update your Zero Trust organization DoH settings
      tags:
      - Zero Trust Organization
  /accounts/{account_id}/access/organizations/revoke_user:
    post:
      description: Revokes a user's access across all applications.
      operationId: zero-trust-organization-revoke-all-access-tokens-for-a-user
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      requestBody:
        content:
          application/json:
            schema:
              properties:
                email:
                  description: The email of the user to revoke.
                  example: test@example.com
                  type: string
              required:
              - email
        required: true
      responses:
        4xx:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Revoke all Access tokens for a user response failure
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_empty_response'
          description: Revoke all Access tokens for a user response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Revoke all Access tokens for a user
      tags:
      - Zero Trust Organization
components:
  schemas:
    access_allow_authenticate_via_warp:
      description: When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
      example: 'false'
      type: boolean
    access_auth_domain:
      description: The unique subdomain assigned to your Zero Trust organization.
      example: test.cloudflareaccess.com
      type: string
    access_uuid:
      description: UUID
      example: f174e90a-fafe-4643-bbbc-4a0ed4fc8415
      maxLength: 36
      type: string
    access_custom_pages:
      properties:
        forbidden:
          description: The uid of the custom page to use when a user is denied access after failing a non-identity rule.
          example: 699d98642c564d2e855e9661899b7252
          type: string
        identity_denied:
          description: The uid of the custom page to use when a user is denied access.
          example: 699d98642c564d2e855e9661899b7252
          type: string
    access_auto_redirect_to_identity:
      default: false
      description: When set to `true`, users skip the identity provider selection step during login.
      type: boolean
    access_identifier:
      description: Identifier
      example: 023e105f4ecef8ad9ca31a8372d0c353
      maxLength: 32
      type: string
    access_schemas-name:
      description: The name of the service token.
      example: CI/CD token
      type: string
    access_api-response-common-failure:
      properties:
        errors:
          allOf:
          - $ref: '#/components/schemas/access_messages'
          example:
          - code: 7003
            message: No route for the URI
          minLength: 1
        messages:
          allOf:
          - $ref: '#/components/schemas/access_messages'
          example: []
        result:
          enum:
          - null
          nullable: true
          type: object
        success:
          description: Whether the API call was successful
          enum:
          - false
          example: false
          type: boolean
      required:
      - success
      - errors
      - messages
      - result
      type: object
    access_user_seat_expiration_inactive_time:
      description: 'The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`.'
      example: 730h
      type: string
    access_single_response:
      allOf:
      - $ref: '#/components/schemas/access_api-response-single'
      - properties:
          result:
            $ref: '#/components/schemas/access_organizations'
    access_service-tokens:
      properties:
        client_id:
          $ref: '#/components/schemas/access_client_id'
        created_at:
          $ref: '#/components/schemas/access_timestamp'
        duration:
          $ref: '#/components/schemas/access_duration'
        expires_at:
          $ref: '#/components/schemas/access_timestamp'
        id:
          allOf:
          - description: The ID of the service token.
          - $ref: '#/components/schemas/access_uuid'
        name:
          $ref: '#/components/schemas/access_schemas-name'
        updated_at:
          $ref: '#/components/schemas/access_timestamp'
      type: object
    access_session_duration:
      description: 'The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.'
      example: 24h
      type: string
    access_schemas-single_response:
      allOf:
      - $ref: '#/components/schemas/access_api-response-single'
      - properties:
          result:
            $ref: '#/components/schemas/access_service-tokens'
    access_api-response-common:
      properties:
        errors:
          $ref: '#/components/schemas/access_messages'
        messages:
          $ref: '#/components/schemas/access_messages'
        success:
          description: Whether the API call was successful
          enum:
          - true
          example: true
          type: boolean
      required:
      - success
      - errors
      - messages
      type: object
    access_organizations:
      properties:
        allow_authenticate_via_warp:
          $ref: '#/components/schemas/access_allow_authenticate_via_warp'
        auth_domain:
          $ref: '#/components/schemas/access_auth_domain'
        auto_redirect_to_identity:
          $ref: '#/components/schemas/access_auto_redirect_to_identity'
        created_at:
          $ref: '#/components/schemas/access_timestamp'
        custom_pages:
          $ref: '#/components/schemas/access_custom_pages'
        is_ui_read_only:
          $ref: '#/components/schemas/access_is_ui_read_only'
        login_design:
          $ref: '#/components/schemas/access_login_design'
        name:
          $ref: '#/components/schemas/access_name'
        session_duration:
          $ref: '#/components/schemas/access_session_duration'
        ui_read_only_toggle_reason:
          $ref: '#/components/schemas/access_ui_read_only_toggle_reason'
        updated_at:
          $ref: '#/components/schemas/access_timestamp'
        user_seat_expiration_inactive_time:
          $ref: '#/components/schemas/access_user_seat_expiration_inactive_time'
        warp_auth_session_duration:
          $ref: '#/components/schemas/access_warp_auth_session_duration'
      type: object
    access_messages:
      example: []
      items:
        properties:
          code:
            minimum: 1000
            type: integer
          message:
            type: string
        required:
        - code
        - message
        type: object
        uniqueItems: true
      type: array
    access_warp_auth_session_duration:
      description: 'The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h.'
      example: 24h
      type: string
    access_is_ui_read_only:
      description: Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
      example: 'false'
      type: boolean
    access_duration:
      default: 8760h
      description: 'The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).'
      example: 60m
      type: string
    access_timestamp:
      example: '2014-01-01T05:20:00.12345Z'
      format: date-time
      type: string
    access_client_id:
      description: The Client ID for the service token. Access will check for this value in the `CF-Access-Client-ID` request header.
      example: 88bf3b6d86161464f6509f7219099e57.access.example.com
      type: string
    access_login_design:
      properties:
        background_color:
          description: The background color on your login page.
          example: '#c5ed1b'
          type: string
        footer_text:
          description: The text at the bottom of your login page.
          example: This is an example description.
          type: string
        header_text:
          description: The text at the top of your login page.
          example: This is an example description.
          type: string
        logo_path:
          description: The URL of the logo on your login page.
          example: https://example.com/logo.png
          type: string
        text_color:
          description: The text color on your login page.
          example: '#c5ed1b'
          type: string
    access_name:
      description: The name of your Zero Trust organization.
      example: Widget Corps Internal Applications
      type: string
    access_ui_read_only_toggle_reason:
      description: A description of the reason why the UI read only field is being toggled.
      example: Temporarily turn off the UI read only lock to make a change via the UI
      type: string
    access_doh_jwt_duration:
      description: 'The duration the DoH JWT is valid for. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.  Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h'
      example: 800h
      type: string
    access_api-response-single:
      allOf:
      - $ref: '#/components/schemas/access_api-response-common'
      type: object
    access_empty_response:
      allOf:
      - properties:
          result:
            enum:
            - true
            - false
            example: true
            type: boolean
          success:
            enum:
            - true
            - false
            example: true
            type: boolean
  securitySchemes:
    hmac:
      type: apiKey
      name: Authorization
      in: header
      description: Amazon Signature authorization v4
      x-amazon-apigateway-authtype: awsSigv4
externalDocs:
  description: Amazon Web Services documentation
  url: https://docs.aws.amazon.com/apigateway/
x-hasEquivalentPaths: true