API standards and multilingual preset SDKs
The OpenAPI of this product (cloudsso/2021-05-15) uses the RPC signature style. We have encapsulated SDKs for common programming languages for developers. Developers can download the SDK to directly call this product's OpenAPI without worrying about technical details. If the existing SDK does not meet your needs, you can use the signature mechanism for self-signing integration. Since the details of self-signing are very complex, it may take around 5 business days. Therefore, we recommend joining our DingTalk service group (147535001692) and conducting signature integration under expert guidance.
Before using the API, you need to prepare your identity account and access key (AccessKey) to effectively access the API through client tools (such as SDK and CLI). For details, see Obtain an AccessKey.
Custom signature scenarios
If your business scenario has special requirements and you need to integrate the API through self-signing, we recommend consulting our technical support team first (DingTalk service group: 147535001692) to obtain professional guidance and ensure efficient integration.
Account and security preparation
Alibaba Cloud accounts have full administrative permissions over all resources. Once an AccessKey is compromised, all associated resources will be at risk of unauthorized access. To ensure security, it is recommended to create a RAM user with only API access permissions and configure its AccessKey, while configuring RAM policies based on the principle of least privilege (PoLP). Use the Alibaba Cloud account only in specific scenarios where Alibaba Cloud account permissions are explicitly required.
Manage cloudSSO
|
API |
Title |
Description |
| EnableService | EnableService | Enables CloudSSO. |
| DisableService | DisableService | Disables CloudSSO. |
| GetServiceStatus | GetServiceStatus | Queries the status of CloudSSO. |
Manage users
|
API |
Title |
Description |
| UpdateUserStatus | UpdateUserStatus | Changes the status of a user. |
| DeleteMFADeviceForUser | DeleteMFADeviceForUser | Unbinds a multi-factor authentication (MFA) device from a user. |
| UpdateUserMFAAuthenticationSettings | UpdateUserMFAAuthenticationSettings | Modifies the multi-factor authentication (MFA) setting of a single user. |
| GetUserId | GetUserId | Queries the ID of a user in a resource directory by using the ExternalId parameter. |
Manage user groups
|
API |
Title |
Description |
| AddUserToGroup | AddUserToGroup | Adds a user to a group. |
Manage SCIM synchronization
|
API |
Title |
Description |
| CreateSCIMServerCredential | CreateSCIMServerCredential | Creates a System for Cross-domain Identity Management (SCIM) credential. |
| UpdateSCIMServerCredentialStatus | UpdateSCIMServerCredentialStatus | Enables or disables a System for Cross-domain Identity Management (SCIM) credential. |
| DeleteSCIMServerCredential | DeleteSCIMServerCredential | Deletes a System for Cross-domain Identity Management (SCIM) credential. |
Manage single sign-on
|
API |
Title |
Description |
| CreateAccessConfiguration | CreateAccessConfiguration | Creates an access configuration. |
| ListAccessConfigurations | ListAccessConfigurations | Queries a list of access configurations. |
| GetAccessConfiguration | GetAccessConfiguration | Queries the details of an access configuration. |
| UpdateAccessConfiguration | UpdateAccessConfiguration | Modifies information about an access configuration. |
| DeleteAccessConfiguration | DeleteAccessConfiguration | Deletes an access configuration. |
| AddPermissionPolicyToAccessConfiguration | AddPermissionPolicyToAccessConfiguration | Adds a policy to an access configuration. |
| RemovePermissionPolicyFromAccessConfiguration | RemovePermissionPolicyFromAccessConfiguration | Removes a policy from an access configuration. |
| UpdateInlinePolicyForAccessConfiguration | UpdateInlinePolicyForAccessConfiguration | Modifies an inline policy that is created for an access configuration. |
Manage access configurations
|
API |
Title |
Description |
| ProvisionAccessConfiguration | ProvisionAccessConfiguration | Provisions an access configuration for an account in your resource directory. |
| DeprovisionAccessConfiguration | DeprovisionAccessConfiguration | De-provisions an access configuration from an account in your resource directory. |
| ListAccessConfigurationProvisionings | ListAccessConfigurationProvisionings | Queries the access configurations that are provisioned. |
| CreateAccessAssignment | CreateAccessAssignment | Assigns access permissions on an account in your resource directory to a user or a group by using an access configuration. |
| ListAccessAssignments | ListAccessAssignments | Queries the access permissions that are assigned. |
| DeleteAccessAssignment | DeleteAccessAssignment | Removes the access permissions on an account in a resource directory. |
Manage multi-account authorization
|
API |
Title |
Description |
| CreateUserProvisioning | CreateUserProvisioning | Creates a Resource Access Management (RAM) user provisioning. |
| ListUserProvisionings | ListUserProvisionings | Queries Resource Access Management (RAM) user provisionings. |
| UpdateUserProvisioning | UpdateUserProvisioning | Modifies a Resource Access Management (RAM) user provisioning. |
| DeleteUserProvisioning | DeleteUserProvisioning | Deletes a Resource Access Management (RAM) user provisioning. |
| ListUserProvisioningEvents | ListUserProvisioningEvents | Queries Resource Access Management (RAM) user provisioning events. |
Manage RAM user synchronization
|
API |
Title |
Description |
| AddExternalSAMLIdPCertificate | AddExternalSAMLIdPCertificate | Adds a Security Assertion Markup Language (SAML) signing certificate. |
| ClearExternalSAMLIdentityProvider | ClearExternalSAMLIdentityProvider | Clears the configurations of a Security Assertion Markup Language (SAML) identity provider (IdP). |
| CreateDirectory | CreateDirectory | Creates a directory. |
| CreateGroup | CreateGroup | Creates a group. |
| CreateUser | CreateUser | Creates a user. |
| DeleteDirectory | DeleteDirectory | Deletes a directory. |
| DeleteGroup | DeleteGroup | Deletes a group. |
| DeleteUser | DeleteUser | Deletes a user. |
| DeleteUserProvisioningEvent | DeleteUserProvisioningEvent | Deletes a Resource Access Management (RAM) user provisioning event. |
| DisableDelegateAccount | DisableDelegateAccount | Disables the delegated administrator account of CloudSSO. |
| EnableDelegateAccount | EnableDelegateAccount | Enables the delegated administrator account of CloudSSO. |
| GetDirectory | GetDirectory | Queries information about a directory. |
| GetDirectorySAMLServiceProviderInfo | GetDirectorySAMLServiceProviderInfo | Queries information about a Security Assertion Markup Language (SAML) service provider (SP). |
| GetDirectoryStatistics | GetDirectoryStatistics | Queries the statistics of a directory. |
| GetExternalSAMLIdentityProvider | GetExternalSAMLIdentityProvider | Queries the configurations of a Security Assertion Markup Language (SAML) identity provider (IdP). |
| GetGroup | GetGroup | Queries information about a group. |
| GetLoginPreference | GetLoginPreference | Queries the logon preference of CloudSSO users. |
| GetMFAAuthenticationSettingInfo | GetMFAAuthenticationSettingInfo | Queries the multi-factor authentication (MFA) setting of all users. |
| GetMFAAuthenticationSettings | GetMFAAuthenticationSettings | Queries the multi-factor authentication (MFA) setting of all users. |
| GetMFAAuthenticationStatus | GetMFAAuthenticationStatus | Checks whether multi-factor authentication (MFA) is enabled for users. |
| GetPasswordPolicy | GetPasswordPolicy | Queries the password policy of CloudSSO users. |
| GetSCIMSynchronizationStatus | GetSCIMSynchronizationStatus | Queries the status of System for Cross-domain Identity Management (SCIM) synchronization. |
| GetTask | GetTask | Queries information about an asynchronous task. |
| GetTaskStatus | GetTaskStatus | Queries the status of an asynchronous task. |
| GetUser | GetUser | Queries the information about a user. |
| GetUserMFAAuthenticationSettings | GetUserMFAAuthenticationSettings | Queries the multi-factor authentication (MFA) setting of a single user. |
| GetUserProvisioning | GetUserProvisioning | Queries a Resource Access Management (RAM) user provisioning. |
| GetUserProvisioningConfiguration | GetUserProvisioningConfiguration | Queries the global configurations of a Resource Access Management (RAM) user provisioning. |
| GetUserProvisioningEvent | GetUserProvisioningEvent | Queries the information about a Resource Access Management (RAM) user provisioning. |
| GetUserProvisioningRdAccountStatistics | GetUserProvisioningRdAccountStatistics | Queries statistics of Resource Access Management (RAM) user provisioning events that are created for the member in a resource directory. |
| GetUserProvisioningStatistics | GetUserProvisioningStatistics | Queries the statistics of a Resource Access Management (RAM) user provisioning. |
| ListDirectories | ListDirectories | Queries directories. |
| ListExternalSAMLIdPCertificates | ListExternalSAMLIdPCertificates | Queries Security Assertion Markup Language (SAML) signing certificates. |
| ListGroupMembers | ListGroupMembers | Queries the users in a group. |
| ListGroups | ListGroups | Queries groups. |
| ListJoinedGroupsForUser | ListJoinedGroupsForUser | Queries the groups to which a user is added. |
| ListMFADevicesForUser | ListMFADevicesForUser | Queries the multi-factor authentication (MFA) devices that are bound to a user. Up to two MFA devices can be bound to a user. |
| ListPermissionPoliciesInAccessConfiguration | ListPermissionPoliciesInAccessConfiguration | Queries the policies that are created for an access configuration. |
| ListSCIMServerCredentials | ListSCIMServerCredentials | Queries Cross-domain Identity Management (SCIM) credentials. |
| ListTasks | ListTasks | Queries asynchronous tasks. |
| ListUsers | ListUsers | Queries a list of users. |
| RemoveExternalSAMLIdPCertificate | RemoveExternalSAMLIdPCertificate | Removes a Security Assertion Markup Language (SAML) signing certificate. |
| RemoveUserFromGroup | RemoveUserFromGroup | Removes a user from a group. |
| ResetUserPassword | ResetUserPassword | Resets the password of a user. |
| RetryUserProvisioningEvent | RetryUserProvisioningEvent | Retries a Resource Access Management (RAM) user provisioning event. |
| SetExternalSAMLIdentityProvider | SetExternalSAMLIdentityProvider | Configures a Security Assertion Markup Language (SAML) identity provider (IdP). |
| SetLoginPreference | SetLoginPreference | Configures the logon preference of CloudSSO users. |
| SetMFAAuthenticationStatus | SetMFAAuthenticationStatus | Enables or disables multi-factor authentication (MFA) for users in a directory. |
| SetPasswordPolicy | SetPasswordPolicy | Configures a password policy for CloudSSO users. |
| SetSCIMSynchronizationStatus | SetSCIMSynchronizationStatus | Enables or disables System for Cross-domain Identity Management (SCIM) synchronization. |
| UpdateDirectory | UpdateDirectory | Changes the name of a directory. |
| UpdateGroup | UpdateGroup | Modifies the information about a group. |
| UpdateMFAAuthenticationSettings | UpdateMFAAuthenticationSettings | Modifies the multi-factor authentication (MFA) setting of all users. |
| UpdateUser | UpdateUser | Modifies information about a user. |
| UpdateUserProvisioningConfiguration | UpdateUserProvisioningConfiguration | Modifies the global configurations of a Resource Access Management (RAM) user provisioning. |