API standards and multilingual preset SDKs
The OpenAPI of this product (cloudsso/2021-05-15) uses the RPC signature style. We have encapsulated SDKs for common programming languages for developers. Developers can download the SDK to directly call this product's OpenAPI without worrying about technical details. If the existing SDK does not meet your needs, you can use the signature mechanism for self-signing integration. Since the details of self-signing are very complex, it may take around 5 business days. Therefore, we recommend joining our DingTalk service group (147535001692) and conducting signature integration under expert guidance.
Before using the API, you need to prepare your identity account and access key (AccessKey) to effectively access the API through client tools (such as SDK and CLI). For details, see Obtain an AccessKey.
Custom signature scenarios
If your business scenario has special requirements and you need to integrate the API through self-signing, we recommend consulting our technical support team first (DingTalk service group: 147535001692) to obtain professional guidance and ensure efficient integration.
Account and security preparation
Alibaba Cloud accounts have full administrative permissions over all resources. Once an AccessKey is compromised, all associated resources will be at risk of unauthorized access. To ensure security, it is recommended to create a RAM user with only API access permissions and configure its AccessKey, while configuring RAM policies based on the principle of least privilege (PoLP). Use the Alibaba Cloud account only in specific scenarios where Alibaba Cloud account permissions are explicitly required.
Manage cloudSSO
|
API |
Title |
Description |
| EnableService | EnableService | Enables CloudSSO. |
| DisableService | DisableService | Disables CloudSSO. |
| GetServiceStatus | GetServiceStatus | Queries the status of CloudSSO. |
| ListDirectories | ListDirectories | Queries directories. |
| GetDirectory | GetDirectory | Queries information about a directory. |
| GetDirectoryStatistics | GetDirectoryStatistics | Queries the statistics of a directory. |
| UpdateDirectory | UpdateDirectory | Changes the name of a directory. |
| EnableDelegateAccount | EnableDelegateAccount | Enables the delegated administrator account of CloudSSO. |
| DisableDelegateAccount | DisableDelegateAccount | Disables the delegated administrator account of CloudSSO. |
Manage users
|
API |
Title |
Description |
| UpdateUserStatus | UpdateUserStatus | Changes the status of a user. |
| ListMFADevicesForUser | Query MFA devices for a user | Queries the MFA device list of a user. Each user can have a maximum of two MFA devices. |
| DeleteMFADeviceForUser | Delete the MFA device of a user | Deletes the MFA device of a user. |
| UpdateMFAAuthenticationSettings | Modify global MFA settings | Modifies the global multi-factor authentication (MFA) settings. |
| GetMFAAuthenticationSettings | GetMFAAuthenticationSettings | Queries the multi-factor authentication (MFA) setting of all users. |
| UpdateUserMFAAuthenticationSettings | UpdateUserMFAAuthenticationSettings | Modifies the multi-factor authentication (MFA) setting of a single user. |
| GetUserMFAAuthenticationSettings | GetUserMFAAuthenticationSettings | Queries the multi-factor authentication (MFA) setting of a single user. |
| GetMFAAuthenticationSettingInfo | Query global MFA configuration | Queries the global multi-factor authentication (MFA) configuration. |
| SetLoginPreference | SetLoginPreference | Configures the logon preference of CloudSSO users. |
| GetLoginPreference | GetLoginPreference | Queries the logon preference of CloudSSO users. |
| SetPasswordPolicy | SetPasswordPolicy | Configures a password policy for CloudSSO users. |
| GetPasswordPolicy | GetPasswordPolicy | Queries the password policy of CloudSSO users. |
| GetUserId | GetUserId | Queries the ID of a user in a resource directory by using the ExternalId parameter. |
Manage user groups
|
API |
Title |
Description |
| AddUserToGroup | AddUserToGroup | Adds a user to a group. |
| RemoveUserFromGroup | RemoveUserFromGroup | Removes a user from a group. |
| ListJoinedGroupsForUser | ListJoinedGroupsForUser | Queries the groups to which a user is added. |
| ListGroupMembers | ListGroupMembers | Queries the users in a group. |
Manage SCIM synchronization
|
API |
Title |
Description |
| CreateSCIMServerCredential | CreateSCIMServerCredential | Creates a System for Cross-domain Identity Management (SCIM) credential. |
| ListSCIMServerCredentials | ListSCIMServerCredentials | Queries Cross-domain Identity Management (SCIM) credentials. |
| UpdateSCIMServerCredentialStatus | UpdateSCIMServerCredentialStatus | Enables or disables a System for Cross-domain Identity Management (SCIM) credential. |
| DeleteSCIMServerCredential | DeleteSCIMServerCredential | Deletes a System for Cross-domain Identity Management (SCIM) credential. |
| SetSCIMSynchronizationStatus | SetSCIMSynchronizationStatus | Enables or disables System for Cross-domain Identity Management (SCIM) synchronization. |
| GetSCIMSynchronizationStatus | GetSCIMSynchronizationStatus | Queries the status of System for Cross-domain Identity Management (SCIM) synchronization. |
Manage single sign-on
|
API |
Title |
Description |
| GetDirectorySAMLServiceProviderInfo | GetDirectorySAMLServiceProviderInfo | Queries information about a Security Assertion Markup Language (SAML) service provider (SP). |
| SetExternalSAMLIdentityProvider | SetExternalSAMLIdentityProvider | Configures a Security Assertion Markup Language (SAML) identity provider (IdP). |
| GetExternalSAMLIdentityProvider | GetExternalSAMLIdentityProvider | Queries the configurations of a Security Assertion Markup Language (SAML) identity provider (IdP). |
| ClearExternalSAMLIdentityProvider | ClearExternalSAMLIdentityProvider | Clears the configurations of a Security Assertion Markup Language (SAML) identity provider (IdP). |
| AddExternalSAMLIdPCertificate | AddExternalSAMLIdPCertificate | Adds a Security Assertion Markup Language (SAML) signing certificate. |
| ListExternalSAMLIdPCertificates | ListExternalSAMLIdPCertificates | Queries Security Assertion Markup Language (SAML) signing certificates. |
| RemoveExternalSAMLIdPCertificate | RemoveExternalSAMLIdPCertificate | Removes a Security Assertion Markup Language (SAML) signing certificate. |
Manage access configurations
|
API |
Title |
Description |
| CreateAccessConfiguration | Create an access configuration | Creates an access configuration. |
| ListAccessConfigurations | Query access configurations | Queries the list of access configurations. |
| GetAccessConfiguration | Query access configuration information | Queries the information about an access configuration. |
| UpdateAccessConfiguration | UpdateAccessConfiguration | Modifies information about an access configuration. |
| DeleteAccessConfiguration | DeleteAccessConfiguration | Deletes an access configuration. |
| AddPermissionPolicyToAccessConfiguration | AddPermissionPolicyToAccessConfiguration | Adds a policy to an access configuration. |
| RemovePermissionPolicyFromAccessConfiguration | RemovePermissionPolicyFromAccessConfiguration | Removes a policy from an access configuration. |
| UpdateInlinePolicyForAccessConfiguration | UpdateInlinePolicyForAccessConfiguration | Modifies an inline policy that is created for an access configuration. |
| ListPermissionPoliciesInAccessConfiguration | ListPermissionPoliciesInAccessConfiguration | Queries the policies that are created for an access configuration. |
Manage multi-account authorization
|
API |
Title |
Description |
| ProvisionAccessConfiguration | ProvisionAccessConfiguration | Provisions an access configuration for an account in your resource directory. |
| DeprovisionAccessConfiguration | DeprovisionAccessConfiguration | De-provisions an access configuration from an account in your resource directory. |
| ListAccessConfigurationProvisionings | ListAccessConfigurationProvisionings | Queries the access configurations that are provisioned. |
| CreateAccessAssignment | CreateAccessAssignment | Assigns access permissions on an account in your resource directory to a user or a group by using an access configuration. |
| ListAccessAssignments | ListAccessAssignments | Queries the access permissions that are assigned. |
| DeleteAccessAssignment | DeleteAccessAssignment | Removes the access permissions on an account in a resource directory. |
Manage RAM user synchronization
|
API |
Title |
Description |
| CreateUserProvisioning | CreateUserProvisioning | Creates a Resource Access Management (RAM) user provisioning. |
| GetUserProvisioning | GetUserProvisioning | Queries a Resource Access Management (RAM) user provisioning. |
| ListUserProvisionings | ListUserProvisionings | Queries Resource Access Management (RAM) user provisionings. |
| UpdateUserProvisioning | UpdateUserProvisioning | Modifies a Resource Access Management (RAM) user provisioning. |
| DeleteUserProvisioning | DeleteUserProvisioning | Deletes a Resource Access Management (RAM) user provisioning. |
| UpdateUserProvisioningConfiguration | UpdateUserProvisioningConfiguration | Modifies the global configurations of a Resource Access Management (RAM) user provisioning. |
| GetUserProvisioningConfiguration | GetUserProvisioningConfiguration | Queries the global configurations of a Resource Access Management (RAM) user provisioning. |
| ListUserProvisioningEvents | ListUserProvisioningEvents | Queries Resource Access Management (RAM) user provisioning events. |
| GetUserProvisioningEvent | GetUserProvisioningEvent | Queries the information about a Resource Access Management (RAM) user provisioning. |
| DeleteUserProvisioningEvent | DeleteUserProvisioningEvent | Deletes a Resource Access Management (RAM) user provisioning event. |
| RetryUserProvisioningEvent | RetryUserProvisioningEvent | Retries a Resource Access Management (RAM) user provisioning event. |
| GetUserProvisioningStatistics | GetUserProvisioningStatistics | Queries the statistics of a Resource Access Management (RAM) user provisioning. |
| GetUserProvisioningRdAccountStatistics | GetUserProvisioningRdAccountStatistics | Queries statistics of Resource Access Management (RAM) user provisioning events that are created for the member in a resource directory. |
Others (not maintained)
|
API |
Title |
Description |
| SetMFAAuthenticationStatus | SetMFAAuthenticationStatus | Enables or disables multi-factor authentication (MFA) for users in a directory. |
| GetMFAAuthenticationStatus | GetMFAAuthenticationStatus | Checks whether multi-factor authentication (MFA) is enabled for users. |
Others
|
API |
Title |
Description |
| CreateDirectory | CreateDirectory | Creates a directory. |
| CreateGroup | CreateGroup | Creates a group. |
| CreateUser | Create a user | Creates a user by calling CreateUser. |
| DeleteDirectory | DeleteDirectory | Deletes a directory. |
| DeleteGroup | DeleteGroup | Deletes a group. |
| DeleteUser | DeleteUser | Deletes a user. |
| GetAttributePassingSetting | Query attribute passing settings | Queries the attribute passing settings of a specified directory to retrieve the current configuration of the SourceIdentity pass-through mode. |
| GetGroup | GetGroup | Queries information about a group. |
| GetTask | GetTask | Queries information about an asynchronous task. |
| GetTaskStatus | GetTaskStatus | Queries the status of an asynchronous task. |
| GetUser | Query user information | Queries the information about a specified user. |
| ListGroups | ListGroups | Queries groups. |
| ListTasks | ListTasks | Queries asynchronous tasks. |
| ListUsers | Query user list | Queries a list of users. |
| ResetUserPassword | ResetUserPassword | Resets the password of a user. |
| UpdateAttributePassingSetting | Update attribute passing settings | Updates the attribute passing settings for a specified directory, allowing you to set the SourceIdentity pass-through mode to IdP, UserName, or Disabled. |
| UpdateGroup | UpdateGroup | Modifies the information about a group. |
| UpdateUser | UpdateUser | Modifies information about a user. |