openapi: 3.0.1 info: description: "The MongoDB Atlas Administration API allows developers to manage all components in MongoDB Atlas.\n\nThe Atlas Administration API supports OAuth2 Service Accounts and HTTP Digest-based API keys. Service accounts are the recommended authentication method and API keys are considered a legacy option.\n\nTo authenticate with a Service Account, first exchange its client ID and secret for an access token using the OAuth 2.0 Client Credentials flow. Atlas provides a token endpoint at `POST https://cloud.mongodb.com/api/oauth/token`, which returns a Bearer token that is reusable and valid for 1 hour (3600 seconds).\n\nFor example, to [return a list of your organizations](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listorgs) with [cURL](https://en.wikipedia.org/wiki/CURL), first generate an access token and then use that token to call the same Atlas Administration API endpoint shown in the current example:\n\n```\nACCESS_TOKEN=$(curl -fsS --request POST https://cloud.mongodb.com/api/oauth/token \\\n --header \"Authorization: Basic $(printf '%s' \"${CLIENT_ID}:${CLIENT_SECRET}\" | base64 | tr -d '\\n')\" \\\n --header \"Content-Type: application/x-www-form-urlencoded\" \\\n --header \"Accept: application/json\" \\\n --data \"grant_type=client_credentials\" | jq -r '.access_token')\n\ncurl --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/orgs?pretty=true\"\n```\n\nIf your organization requires an IP access list for the Atlas Administration API, the token can be created from any IP address, but the API call that uses the token must originate from an allowed IP.\n\nTo learn more, see [Get Started with the Atlas Administration API](https://www.mongodb.com/docs/atlas/configure-api-access/). For support, see [MongoDB Support](https://www.mongodb.com/support/get-started).\n\nYou can also explore the various endpoints available through the Atlas Administration API in MongoDB's [Postman workspace](https://www.postman.com/mongodb-devrel/workspace/mongodb-atlas-administration-apis/) (requires a Postman account)." license: name: CC BY-NC-SA 3.0 US url: https://creativecommons.org/licenses/by-nc-sa/3.0/us/ termsOfService: https://www.mongodb.com/mongodb-management-service-terms-and-conditions title: MongoDB Atlas Administration Access Tracking Cloud Provider Access API version: '2.0' x-xgen-sha: 3d70e065843c008b9871ea7836c98c9de6f202f9 servers: - url: https://cloud.mongodb.com security: - ServiceAccounts: [] - DigestAuth: [] tags: - description: Returns, adds, authorizes, and removes AWS IAM roles in Atlas. name: Cloud Provider Access paths: /api/atlas/v2/groups/{groupId}/cloudProviderAccess: get: description: Returns all cloud provider access roles with access to the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role. operationId: listGroupCloudProviderAccess parameters: - $ref: '#/components/parameters/envelope' - $ref: '#/components/parameters/groupId' - $ref: '#/components/parameters/pretty' responses: '200': content: application/vnd.atlas.2023-01-01+json: schema: $ref: '#/components/schemas/CloudProviderAccessRoles' x-xgen-version: '2023-01-01' description: OK headers: RateLimit-Limit: $ref: '#/components/headers/HeaderRateLimitLimit' RateLimit-Remaining: $ref: '#/components/headers/HeaderRateLimitRemaining' '401': $ref: '#/components/responses/unauthorized' '403': $ref: '#/components/responses/forbidden' '404': $ref: '#/components/responses/notFound' '429': $ref: '#/components/responses/tooManyRequests' '500': $ref: '#/components/responses/internalServerError' summary: Return All Cloud Provider Access Roles tags: - Cloud Provider Access x-codeSamples: - lang: cURL label: Atlas CLI source: atlas api cloudProviderAccess listCloudProviderAccess --help - lang: go label: Go source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.ListGroupCloudProviderAccessApiParams{}\n\tsdkResp, httpResp, err := client.CloudProviderAccessApi.\n\t\tListGroupCloudProviderAccessWithParams(ctx, params).\n\t\tExecute()\n}\n" - lang: cURL label: curl (Service Accounts) source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess?pretty=true\"" - lang: cURL label: curl (Digest) source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess?pretty=true\"" x-rolesRequirements: - Project Owner x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Cloud-Provider-Access/operation/listGroupCloudProviderAccess x-xgen-operation-id-override: listCloudProviderAccess post: description: Creates one access role for the specified cloud provider. Some MongoDB Cloud features use these cloud provider access roles for authentication. To use this resource, the requesting Service Account or API Key must have the Project Owner role. For the GCP provider, if the project folder is not yet provisioned, Atlas will now create the role asynchronously. An intermediate role with status `IN_PROGRESS` will be returned, and the final service account will be provisioned. Once the GCP project is set up, subsequent requests will create the service account synchronously. externalDocs: description: Set Up Access to Cloud Providers url: https://www.mongodb.com/docs/atlas/security/cloud-provider-access/ operationId: createGroupCloudProviderAccess parameters: - $ref: '#/components/parameters/envelope' - $ref: '#/components/parameters/groupId' - $ref: '#/components/parameters/pretty' requestBody: content: application/vnd.atlas.2023-01-01+json: schema: $ref: '#/components/schemas/CloudProviderAccessRoleRequest' description: Creates one role for the specified cloud provider. required: true responses: '200': content: application/vnd.atlas.2023-01-01+json: schema: $ref: '#/components/schemas/CloudProviderAccessRole' x-xgen-version: '2023-01-01' description: OK headers: RateLimit-Limit: $ref: '#/components/headers/HeaderRateLimitLimit' RateLimit-Remaining: $ref: '#/components/headers/HeaderRateLimitRemaining' '401': $ref: '#/components/responses/unauthorized' '403': $ref: '#/components/responses/forbidden' '404': $ref: '#/components/responses/notFound' '429': $ref: '#/components/responses/tooManyRequests' '500': $ref: '#/components/responses/internalServerError' summary: Create One Cloud Provider Access Role tags: - Cloud Provider Access x-codeSamples: - lang: cURL label: Atlas CLI source: atlas api cloudProviderAccess createCloudProviderAccess --help - lang: go label: Go source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.CreateGroupCloudProviderAccessApiParams{}\n\tsdkResp, httpResp, err := client.CloudProviderAccessApi.\n\t\tCreateGroupCloudProviderAccessWithParams(ctx, params).\n\t\tExecute()\n}\n" - lang: cURL label: curl (Service Accounts) source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess\" \\\n -d '{ }'" - lang: cURL label: curl (Digest) source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess\" \\\n -d '{ }'" x-rolesRequirements: - Project Owner x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Cloud-Provider-Access/operation/createGroupCloudProviderAccess x-xgen-operation-id-override: createCloudProviderAccess /api/atlas/v2/groups/{groupId}/cloudProviderAccess/{cloudProvider}/{roleId}: delete: description: Revokes access to the specified project for the specified access role. To use this resource, the requesting Service Account or API Key must have the Project Owner role. operationId: deauthorizeGroupCloudProviderAccessRole parameters: - $ref: '#/components/parameters/envelope' - $ref: '#/components/parameters/groupId' - $ref: '#/components/parameters/pretty' - description: Human-readable label that identifies the cloud provider of the role to deauthorize. in: path name: cloudProvider required: true schema: enum: - AWS - AZURE - GCP type: string - description: Unique 24-hexadecimal digit string that identifies the role. in: path name: roleId required: true schema: pattern: ^([a-f0-9]{24})$ type: string responses: '204': content: application/vnd.atlas.2023-01-01+json: x-xgen-version: '2023-01-01' description: No Content headers: RateLimit-Limit: $ref: '#/components/headers/HeaderRateLimitLimit' RateLimit-Remaining: $ref: '#/components/headers/HeaderRateLimitRemaining' '400': $ref: '#/components/responses/badRequest' '401': $ref: '#/components/responses/unauthorized' '403': $ref: '#/components/responses/forbidden' '404': $ref: '#/components/responses/notFound' '429': $ref: '#/components/responses/tooManyRequests' '500': $ref: '#/components/responses/internalServerError' summary: Deauthorize One Cloud Provider Access Role tags: - Cloud Provider Access x-codeSamples: - lang: cURL label: Atlas CLI source: atlas api cloudProviderAccess deauthorizeProviderAccessRole --help - lang: go label: Go source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.DeauthorizeGroupCloudProviderAccessRoleApiParams{}\n\thttpResp, err := client.CloudProviderAccessApi.\n\t\tDeauthorizeGroupCloudProviderAccessRoleWithParams(ctx, params).\n\t\tExecute()\n}\n" - lang: cURL label: curl (Service Accounts) source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess/{cloudProvider}/{roleId}\"" - lang: cURL label: curl (Digest) source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess/{cloudProvider}/{roleId}\"" x-rolesRequirements: - Project Owner x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Cloud-Provider-Access/operation/deauthorizeGroupCloudProviderAccessRole x-xgen-method-verb-override: customMethod: 'True' verb: deauthorizeRole x-xgen-operation-id-override: deauthorizeProviderAccessRole /api/atlas/v2/groups/{groupId}/cloudProviderAccess/{roleId}: get: description: Returns the access role with the specified id and with access to the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role. operationId: getGroupCloudProviderAccess parameters: - $ref: '#/components/parameters/envelope' - $ref: '#/components/parameters/groupId' - $ref: '#/components/parameters/pretty' - description: Unique 24-hexadecimal digit string that identifies the role. in: path name: roleId required: true schema: pattern: ^([a-f0-9]{24})$ type: string responses: '200': content: application/vnd.atlas.2023-01-01+json: schema: $ref: '#/components/schemas/CloudProviderAccessRole' x-xgen-version: '2023-01-01' description: OK headers: RateLimit-Limit: $ref: '#/components/headers/HeaderRateLimitLimit' RateLimit-Remaining: $ref: '#/components/headers/HeaderRateLimitRemaining' '401': $ref: '#/components/responses/unauthorized' '403': $ref: '#/components/responses/forbidden' '404': $ref: '#/components/responses/notFound' '429': $ref: '#/components/responses/tooManyRequests' '500': $ref: '#/components/responses/internalServerError' summary: Return One Cloud Provider Access Role tags: - Cloud Provider Access x-codeSamples: - lang: cURL label: Atlas CLI source: atlas api cloudProviderAccess getCloudProviderAccess --help - lang: go label: Go source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.GetGroupCloudProviderAccessApiParams{}\n\tsdkResp, httpResp, err := client.CloudProviderAccessApi.\n\t\tGetGroupCloudProviderAccessWithParams(ctx, params).\n\t\tExecute()\n}\n" - lang: cURL label: curl (Service Accounts) source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess/{roleId}?pretty=true\"" - lang: cURL label: curl (Digest) source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess/{roleId}?pretty=true\"" x-rolesRequirements: - Project Owner x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Cloud-Provider-Access/operation/getGroupCloudProviderAccess x-xgen-operation-id-override: getCloudProviderAccess patch: description: Grants access to the specified project for the specified access role. To use this resource, the requesting Service Account or API Key must have the Project Owner role. This API endpoint is one step in a procedure to create unified access for MongoDB Cloud services. This is not required for GCP service account access. externalDocs: description: Set Up Access to Cloud Providers url: https://www.mongodb.com/docs/atlas/security/cloud-provider-access/ operationId: authorizeGroupCloudProviderAccessRole parameters: - $ref: '#/components/parameters/envelope' - $ref: '#/components/parameters/groupId' - $ref: '#/components/parameters/pretty' - description: Unique 24-hexadecimal digit string that identifies the role. in: path name: roleId required: true schema: pattern: ^([a-f0-9]{24})$ type: string requestBody: content: application/vnd.atlas.2023-01-01+json: schema: $ref: '#/components/schemas/CloudProviderAccessRoleRequestUpdate' description: Grants access to the specified project for the specified access role. required: true responses: '200': content: application/vnd.atlas.2023-01-01+json: schema: $ref: '#/components/schemas/CloudProviderAccessRole' x-xgen-version: '2023-01-01' description: OK headers: RateLimit-Limit: $ref: '#/components/headers/HeaderRateLimitLimit' RateLimit-Remaining: $ref: '#/components/headers/HeaderRateLimitRemaining' '400': $ref: '#/components/responses/badRequest' '401': $ref: '#/components/responses/unauthorized' '403': $ref: '#/components/responses/forbidden' '404': $ref: '#/components/responses/notFound' '409': $ref: '#/components/responses/conflict' '429': $ref: '#/components/responses/tooManyRequests' '500': $ref: '#/components/responses/internalServerError' summary: Authorize One Cloud Provider Access Role tags: - Cloud Provider Access x-codeSamples: - lang: cURL label: Atlas CLI source: atlas api cloudProviderAccess authorizeProviderAccessRole --help - lang: go label: Go source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.AuthorizeGroupCloudProviderAccessRoleApiParams{}\n\tsdkResp, httpResp, err := client.CloudProviderAccessApi.\n\t\tAuthorizeGroupCloudProviderAccessRoleWithParams(ctx, params).\n\t\tExecute()\n}\n" - lang: cURL label: curl (Service Accounts) source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess/{roleId}\" \\\n -d '{ }'" - lang: cURL label: curl (Digest) source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/cloudProviderAccess/{roleId}\" \\\n -d '{ }'" x-rolesRequirements: - Project Owner x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Cloud-Provider-Access/operation/authorizeGroupCloudProviderAccessRole x-xgen-method-verb-override: customMethod: 'True' verb: authorizeRole x-xgen-operation-id-override: authorizeProviderAccessRole components: responses: internalServerError: content: application/json: example: detail: (This is just an example, the exception may not be related to this endpoint) error: 500 errorCode: UNEXPECTED_ERROR reason: Internal Server Error schema: $ref: '#/components/schemas/ApiError' description: Internal Server Error. forbidden: content: application/json: example: detail: (This is just an example, the exception may not be related to this endpoint) error: 403 errorCode: CANNOT_CHANGE_GROUP_NAME reason: Forbidden schema: $ref: '#/components/schemas/ApiError' description: Forbidden. tooManyRequests: content: application/json: example: detail: (This is just an example, the exception may not be related to this endpoint) error: 429 errorCode: RATE_LIMITED reason: Too Many Requests schema: $ref: '#/components/schemas/ApiError' description: Too Many Requests. headers: RateLimit-Limit: $ref: '#/components/headers/HeaderRateLimitLimit' RateLimit-Remaining: $ref: '#/components/headers/HeaderRateLimitRemaining' Retry-After: $ref: '#/components/headers/HeaderRetryAfter' unauthorized: content: application/json: example: detail: (This is just an example, the exception may not be related to this endpoint) error: 401 errorCode: NOT_ORG_GROUP_CREATOR reason: Unauthorized schema: $ref: '#/components/schemas/ApiError' description: Unauthorized. conflict: content: application/json: example: detail: '(This is just an example, the exception may not be related to this endpoint) Cannot delete organization link while there is active migration in following project ids: 60c4fd418ebe251047c50554' error: 409 errorCode: CANNOT_DELETE_ORG_ACTIVE_LIVE_MIGRATION_ATLAS_ORG_LINK reason: Conflict schema: $ref: '#/components/schemas/ApiError' description: Conflict. badRequest: content: application/json: example: detail: (This is just an example, the exception may not be related to this endpoint) No provider AWS exists. error: 400 errorCode: VALIDATION_ERROR reason: Bad Request schema: $ref: '#/components/schemas/ApiError' description: Bad Request. notFound: content: application/json: example: detail: (This is just an example, the exception may not be related to this endpoint) Cannot find resource AWS error: 404 errorCode: RESOURCE_NOT_FOUND reason: Not Found schema: $ref: '#/components/schemas/ApiError' description: Not Found. schemas: CloudProviderAccessAWSIAMRole: allOf: - $ref: '#/components/schemas/CloudProviderAccessRole' - properties: atlasAWSAccountArn: description: Amazon Resource Name that identifies the Amazon Web Services (AWS) user account that MongoDB Cloud uses when it assumes the Identity and Access Management (IAM) role. example: arn:aws:iam::772401394250:role/my-test-aws-role maxLength: 2048 minLength: 20 readOnly: true type: string atlasAssumedRoleExternalId: description: Unique external ID that MongoDB Cloud uses when it assumes the IAM role in your Amazon Web Services (AWS) account. format: uuid readOnly: true type: string authorizedDate: description: Date and time when someone authorized this role for the specified cloud service provider. This parameter expresses its value in the ISO 8601 timestamp format in UTC. format: date-time readOnly: true type: string createdDate: description: Date and time when someone created this role for the specified cloud service provider. This parameter expresses its value in the ISO 8601 timestamp format in UTC. format: date-time readOnly: true type: string featureUsages: description: List that contains application features associated with this Amazon Web Services (AWS) Identity and Access Management (IAM) role. items: $ref: '#/components/schemas/CloudProviderAccessFeatureUsage' readOnly: true type: array iamAssumedRoleArn: description: Amazon Resource Name (ARN) that identifies the Amazon Web Services (AWS) Identity and Access Management (IAM) role that MongoDB Cloud assumes when it accesses resources in your AWS account. example: arn:aws:iam::123456789012:root maxLength: 2048 minLength: 20 type: string roleId: description: Unique 24-hexadecimal digit string that identifies the role. example: 32b6e34b3d91647abb20e7b8 pattern: ^([a-f0-9]{24})$ readOnly: true type: string type: object description: Details that describe the features linked to the Amazon Web Services (AWS) Identity and Access Management (IAM) role. required: - providerName type: object ApiError: properties: badRequestDetail: $ref: '#/components/schemas/BadRequestDetail' detail: description: Describes the specific conditions or reasons that cause each type of error. type: string error: description: HTTP status code returned with this error. externalDocs: url: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status format: int32 readOnly: true type: integer errorCode: description: Application error code returned with this error. readOnly: true type: string parameters: description: Parameters used to give more information about the error. items: type: object readOnly: true type: array reason: description: Application error message returned with this error. readOnly: true type: string required: - error - errorCode type: object CloudProviderAccessGCPServiceAccount: allOf: - $ref: '#/components/schemas/CloudProviderAccessRole' - properties: createdDate: description: Date and time when this Google Service Account was created. This parameter expresses its value in the ISO 8601 timestamp format in UTC. format: date-time readOnly: true type: string featureUsages: description: List that contains application features associated with this Google Service Account. items: $ref: '#/components/schemas/CloudProviderAccessFeatureUsage' readOnly: true type: array gcpServiceAccountForAtlas: description: Email address for the Google Service Account created by Atlas. pattern: ^mongodb-atlas-[0-9a-z]{16}@p-[0-9a-z]{24}.iam.gserviceaccount.com$ type: string roleId: description: Unique 24-hexadecimal digit string that identifies the role. example: 32b6e34b3d91647abb20e7b8 pattern: ^([a-f0-9]{24})$ readOnly: true type: string status: description: Provision status of the service account. enum: - IN_PROGRESS - COMPLETE - FAILED - NOT_INITIATED readOnly: true type: string type: object description: Details that describe the features linked to the GCP Service Account. required: - providerName type: object CloudProviderAccessAzureServicePrincipalRequest: description: Details that describe the features linked to the Azure Service Principal. properties: _id: description: Unique 24-hexadecimal digit string that identifies the role. example: 32b6e34b3d91647abb20e7b8 pattern: ^([a-f0-9]{24})$ readOnly: true type: string atlasAzureAppId: description: Azure Active Directory Application ID of Atlas. This field is optional and will be derived from the Azure subscription if not provided. format: uuid type: string createdDate: description: Date and time when this Azure Service Principal was created. This parameter expresses its value in the ISO 8601 timestamp format in UTC. format: date-time readOnly: true type: string featureUsages: description: List that contains application features associated with this Azure Service Principal. items: $ref: '#/components/schemas/CloudProviderAccessFeatureUsage' readOnly: true type: array lastUpdatedDate: description: Date and time when this Azure Service Principal was last updated. This parameter expresses its value in the ISO 8601 timestamp format in UTC. format: date-time readOnly: true type: string providerName: description: Human-readable label that identifies the cloud provider of the role. enum: - AWS - AZURE - GCP type: string servicePrincipalId: description: UUID string that identifies the Azure Service Principal. format: uuid type: string tenantId: description: UUID String that identifies the Azure Active Directory Tenant ID. format: uuid type: string required: - providerName type: object CloudProviderAccessAzureServicePrincipal: allOf: - $ref: '#/components/schemas/CloudProviderAccessRole' - properties: _id: description: Unique 24-hexadecimal digit string that identifies the role. example: 32b6e34b3d91647abb20e7b8 pattern: ^([a-f0-9]{24})$ readOnly: true type: string atlasAzureAppId: description: Azure Active Directory Application ID of Atlas. This field is optional and will be derived from the Azure subscription if not provided. format: uuid type: string createdDate: description: Date and time when this Azure Service Principal was created. This parameter expresses its value in the ISO 8601 timestamp format in UTC. format: date-time readOnly: true type: string featureUsages: description: List that contains application features associated with this Azure Service Principal. items: $ref: '#/components/schemas/CloudProviderAccessFeatureUsage' readOnly: true type: array lastUpdatedDate: description: Date and time when this Azure Service Principal was last updated. This parameter expresses its value in the ISO 8601 timestamp format in UTC. format: date-time readOnly: true type: string servicePrincipalId: description: UUID string that identifies the Azure Service Principal. format: uuid type: string tenantId: description: UUID String that identifies the Azure Active Directory Tenant ID. format: uuid type: string type: object description: Details that describe the features linked to the Azure Service Principal. required: - providerName type: object BadRequestDetail: description: Bad request detail. properties: fields: description: Describes all violations in a client request. items: $ref: '#/components/schemas/FieldViolation' type: array readOnly: true type: object CloudProviderAccessFeatureUsage: description: MongoDB Cloud features associated with this Amazon Web Services (AWS) Identity and Access Management (IAM) role. discriminator: mapping: ATLAS_DATA_LAKE: '#/components/schemas/CloudProviderAccessDataLakeFeatureUsage' ATLAS_LOG_INTEGRATION: '#/components/schemas/CloudProviderAccessAtlasLogIntegrationFeatureUsage' ENCRYPTION_AT_REST: '#/components/schemas/CloudProviderAccessEncryptionAtRestFeatureUsage' EXPORT_SNAPSHOT: '#/components/schemas/CloudProviderAccessExportSnapshotFeatureUsage' PUSH_BASED_LOG_EXPORT: '#/components/schemas/CloudProviderAccessPushBasedLogExportFeatureUsage' propertyName: featureType properties: featureType: description: Human-readable label that describes one MongoDB Cloud feature linked to this Amazon Web Services (AWS) Identity and Access Management (IAM) role. enum: - ATLAS_DATA_LAKE - ENCRYPTION_AT_REST - EXPORT_SNAPSHOT - PUSH_BASED_LOG_EXPORT - ATLAS_LOG_INTEGRATION readOnly: true type: string type: object FieldViolation: properties: description: description: A description of why the request element is bad. type: string field: description: A path that leads to a field in the request body. type: string required: - description - field type: object CloudProviderAccessGCPServiceAccountRequest: description: Details that describe the features linked to the GCP Service Account. properties: createdDate: description: Date and time when this GCP Service Account was created. This parameter expresses its value in the ISO 8601 timestamp format in UTC. format: date-time readOnly: true type: string featureUsages: description: List that contains application features associated with this GCP Service Account. items: $ref: '#/components/schemas/CloudProviderAccessFeatureUsage' readOnly: true type: array gcpServiceAccountForAtlas: description: ID string that identifies the GCP Service Account used by Atlas. readOnly: true type: string providerName: description: Human-readable label that identifies the cloud provider of the role. enum: - AWS - AZURE - GCP type: string roleId: description: Unique 24-hexadecimal digit string that identifies the role. example: 32b6e34b3d91647abb20e7b8 pattern: ^([a-f0-9]{24})$ readOnly: true type: string required: - providerName type: object CloudProviderAccessRole: description: Cloud provider access role. discriminator: mapping: AWS: '#/components/schemas/CloudProviderAccessAWSIAMRole' AZURE: '#/components/schemas/CloudProviderAccessAzureServicePrincipal' GCP: '#/components/schemas/CloudProviderAccessGCPServiceAccount' propertyName: providerName oneOf: - $ref: '#/components/schemas/CloudProviderAccessAWSIAMRole' - $ref: '#/components/schemas/CloudProviderAccessAzureServicePrincipal' - $ref: '#/components/schemas/CloudProviderAccessGCPServiceAccount' properties: providerName: description: Human-readable label that identifies the cloud provider of the role. enum: - AWS - AZURE - GCP type: string required: - providerName type: object CloudProviderAccessRoleRequest: description: Cloud provider access role. discriminator: mapping: AWS: '#/components/schemas/CloudProviderAccessAWSIAMRoleRequest' AZURE: '#/components/schemas/CloudProviderAccessAzureServicePrincipalRequest' GCP: '#/components/schemas/CloudProviderAccessGCPServiceAccountRequest' propertyName: providerName oneOf: - $ref: '#/components/schemas/CloudProviderAccessAWSIAMRoleRequest' - $ref: '#/components/schemas/CloudProviderAccessAzureServicePrincipalRequest' - $ref: '#/components/schemas/CloudProviderAccessGCPServiceAccountRequest' properties: providerName: description: Human-readable label that identifies the cloud provider of the role. enum: - AWS - AZURE - GCP type: string required: - providerName type: object CloudProviderAccessAWSIAMRoleRequest: description: Details that describe the features linked to the Amazon Web Services (AWS) Identity and Access Management (IAM) role. properties: atlasAWSAccountArn: description: Amazon Resource Name that identifies the Amazon Web Services (AWS) user account that MongoDB Cloud uses when it assumes the Identity and Access Management (IAM) role. example: arn:aws:iam::772401394250:role/my-test-aws-role maxLength: 2048 minLength: 20 readOnly: true type: string atlasAssumedRoleExternalId: description: Unique external ID that MongoDB Cloud uses when it assumes the IAM role in your Amazon Web Services (AWS) account. format: uuid readOnly: true type: string authorizedDate: description: Date and time when someone authorized this role for the specified cloud service provider. This parameter expresses its value in the ISO 8601 timestamp format in UTC. format: date-time readOnly: true type: string createdDate: description: Date and time when someone created this role for the specified cloud service provider. This parameter expresses its value in the ISO 8601 timestamp format in UTC. format: date-time readOnly: true type: string featureUsages: description: List that contains application features associated with this Amazon Web Services (AWS) Identity and Access Management (IAM) role. items: $ref: '#/components/schemas/CloudProviderAccessFeatureUsage' readOnly: true type: array providerName: description: Human-readable label that identifies the cloud provider of the role. enum: - AWS - AZURE - GCP type: string roleId: description: Unique 24-hexadecimal digit string that identifies the role. example: 32b6e34b3d91647abb20e7b8 pattern: ^([a-f0-9]{24})$ readOnly: true type: string required: - providerName type: object CloudProviderAccessRoleRequestUpdate: description: Cloud provider access role. discriminator: mapping: AWS: '#/components/schemas/CloudProviderAccessAWSIAMRoleRequestUpdate' AZURE: '#/components/schemas/CloudProviderAccessAzureServicePrincipalRequestUpdate' GCP: '#/components/schemas/CloudProviderAccessGCPServiceAccountRequestUpdate' propertyName: providerName properties: providerName: description: Human-readable label that identifies the cloud provider of the role. enum: - AWS - AZURE - GCP type: string required: - providerName type: object CloudProviderAccessRoles: properties: awsIamRoles: description: List that contains the Amazon Web Services (AWS) IAM roles registered and authorized with MongoDB Cloud. items: $ref: '#/components/schemas/CloudProviderAccessAWSIAMRole' type: array azureServicePrincipals: description: List that contains the Azure Service Principals registered with MongoDB Cloud. items: $ref: '#/components/schemas/CloudProviderAccessAzureServicePrincipal' type: array gcpServiceAccounts: description: List that contains the Google Service Accounts registered and authorized with MongoDB Cloud. items: $ref: '#/components/schemas/CloudProviderAccessGCPServiceAccount' type: array type: object parameters: envelope: description: Flag that indicates whether Application wraps the response in an `envelope` JSON object. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. Endpoints that return a list of results use the results object as an envelope. Application adds the status parameter to the response body. in: query name: envelope schema: default: false type: boolean groupId: description: 'Unique 24-hexadecimal digit string that identifies your project. Use the [/groups](#tag/Projects/operation/listProjects) endpoint to retrieve all projects to which the authenticated user has access. **NOTE**: Groups and projects are synonymous terms. Your group id is the same as your project id. For existing groups, your group/project id remains the same. The resource and corresponding endpoints use the term groups.' in: path name: groupId required: true schema: example: 32b6e34b3d91647abb20e7b8 pattern: ^([a-f0-9]{24})$ type: string pretty: description: Flag that indicates whether the response body should be in the prettyprint format. in: query name: pretty schema: default: false externalDocs: description: Prettyprint url: https://en.wikipedia.org/wiki/Prettyprint type: boolean headers: HeaderRetryAfter: description: The minimum time you should wait, in seconds, before retrying the API request. This header might be returned for 429 or 503 error responses. schema: type: integer HeaderRateLimitLimit: description: The maximum number of requests that a user can make within a specific time window. schema: type: integer HeaderRateLimitRemaining: description: The number of requests remaining in the current rate limit window before the limit is reached. schema: type: integer securitySchemes: DigestAuth: scheme: digest type: http ServiceAccounts: description: Learn more about [Service Accounts](https://www.mongodb.com/docs/atlas/api/service-accounts-overview). flows: clientCredentials: scopes: {} tokenUrl: https://cloud.mongodb.com/api/oauth/token type: oauth2 x-externalLinks: - label: Back to Atlas Docs url: https://www.mongodb.com/docs/atlas/ - label: API Changelog url: https://www.mongodb.com/docs/atlas/reference/api-resources-spec/changelog/ x-topics: - content: The MongoDB Atlas Administration API is rate limited. To learn more about rate limiting, see the [Atlas Documentation on Rate Limiting](http://dochub.mongodb.org/core/atlas-api-rate-limit) title: Rate Limiting