sts — Security Token Service
sts · 2018-08-13
AssumeRole
POST
Request for the temporary security credentials of a role.
Wire call
Converge Cloud is RPC over HTTP. There is one path — / — and the action travels in the X-TC-Action header. The /sts/AssumeRole path used in the OpenAPI document is a documentation convenience so each action is addressable; it is not a route on the server.
curl
curl -sS https://sts.api3.convergecloud.com/ \
-H 'Authorization: TC3-HMAC-SHA256 Credential=<SecretId>/<YYYY-MM-DD>/sts/tc3_request, SignedHeaders=content-type;host;x-tc-action, Signature=<sig>' \
-H 'Content-Type: application/json; charset=utf-8' \
-H 'Host: sts.api3.convergecloud.com' \
-H 'X-TC-Action: AssumeRole' \
-H 'X-TC-Version: 2018-08-13' \
-H 'X-TC-Timestamp: <unix-seconds>' \
-H 'X-TC-Region: luzon' \
-d '{"RoleArn":"<RoleArn>","RoleSessionName":"<RoleSessionName>"}'Request parameters
| Field | Type | Required | Description |
|---|---|---|---|
| RoleArn | string | Yes | Resource descriptions of a role, which can be obtained by clicking the role name in the CAM console. |
| RoleSessionName | string | Yes | User-defined temporary session name. |
| DurationSeconds | integer | No | Specifies the validity period of credentials in seconds. Default value: 7200. Maximum value: 43200 |
| Policy | string | No | Policy description |
| ExternalId | string | No | External role ID, which can be obtained by clicking the role name in the CAM console. |
| Tags | Tag[] | No | List of session tags. Up to 50 tags are allowed. The tag keys can not duplicate. |
| SourceIdentity | string | No | UIN of the initiator |
Response
Fields are returned inside the Response envelope. Converge Cloud answers HTTP 200 for errors as well as successes, so read Response.Error rather than the status code — and test for the presence of that object, because Code is occasionally the empty string.
| Field | Type | Description |
|---|---|---|
| Credentials | Credentials | Temporary security credentials |
| ExpiredTime | integer | Credentials expiration time. A Unix timestamp will be returned which is accurate to the second |
| Expiration | string | Credentials expiration time in UTC time in ISO 8601 format. |
| RequestId | string | The unique request ID, which is returned for each request. RequestId is required for locating a problem. |
Success
{
"Response": {
"Credentials": …,
"ExpiredTime": …,
"RequestId": "…"
}
}Error
{
"Response": {
"Error": { "Code": "…", "Message": "…" },
"RequestId": "…"
}
}Try it
CredentialThe key never leaves this tab — it signs the request here. The signed request goes to /api-relay/sts.
Request bodyvalid JSONPOST sts.api3.convergecloud.com · AssumeRole
Behaviour
Issues temporary credentials. Converge Cloud provides no revocation mechanism; the credentials remain valid until they expire.