# Alibaba Cloud Security Token Service API

> Alibaba Cloud Security Token Service API on Apizie: 5 endpoints (Obtains a Security Token Service (STS) token to assume a Resource Access Management (RAM) role, Obtains a Security Token Service (STS) token for assuming a RAM role during OIDC-based role SSO by calling…, For role-based single sign-on (SSO) that uses Security Assertion Markup Language (SAML), call the…, A call to the GetCallerIdentity operation returns information about the identity of the current caller, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://zieapi.vercel.app/v1/cloud:aliyun-sts/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:aliyun-sts`
- Category: Cloud
- Status: byok
- Source: https://api.alibabacloud.com/product/sts
- Page: https://zieapi.vercel.app/api/cloud/aliyun-sts
- OpenAPI: https://zieapi.vercel.app/api/cloud/aliyun-sts/openapi.json

Alibaba Cloud OpenAPI for Security Token Service (sts, version 2015-04-01). Calls are signed with ACS3-HMAC-SHA256 using your AccessKey ID and secret.

## Endpoints

### Obtains a Security Token Service (STS) token to assume a Resource Access Management (RAM) role
`POST https://zieapi.vercel.app/v1/cloud:aliyun-sts/assume-role` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| DurationSeconds | integer | no | The validity period of the STS token. Unit: seconds. Minimum value: 900. Maximum value: the value of the `MaxSessionDuration` parameter.… |
| Policy | string | no | The policy that specifies the permissions of the returned STS token. This allows you to implement more fine-grained access control. If you… |
| RoleArn | string | yes | The Alibaba Cloud Resource Name (ARN) of the RAM role. The trusted entity of the RAM role is an Alibaba Cloud account. For more… |
| RoleSessionName | string | yes | The name of the role session. The value is user-defined. In most cases, you can set this parameter to the identity of the user who calls… |
| ExternalId | string | no | The external ID of the RAM role. The value of this parameter is provided by an external party and is used to prevent the confused deputy… |
| SourceIdentity | string | no | The source identity information. When a user assumes a role, the source identity of the user can be specified as the initial identity of a… |

### Obtains a Security Token Service (STS) token for assuming a RAM role during OIDC-based role SSO by calling…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-sts/assume-role-with-oidc` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| OIDCProviderArn | string | no | The Alibaba Cloud Resource Name (ARN) of the OIDC IdP. You can view the ARN of the OIDC IdP in the Resource Access Management (RAM)… |
| RoleArn | string | no | The ARN of the RAM role to assume. You can view the role ARN in the Resource Access Management (RAM) console or by calling an API… |
| OIDCToken | string | no | The OIDC token issued by the external IdP. Length: 4 to 20,000 characters. Provide the original OIDC token without Base64 decoding |
| Policy | string | no | An additional permission policy attached to the STS token to further restrict its permissions: If you specify access policy, the final… |
| DurationSeconds | integer | no | The validity period of the token. Unit: seconds. Default value: 3600. Minimum value: 900. Maximum value: the value specified by… |
| RoleSessionName | string | no | The role session name. This is a user-defined parameter. Set this parameter to the identity of the API caller, such as a username. In… |

### For role-based single sign-on (SSO) that uses Security Assertion Markup Language (SAML), call the…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-sts/assume-role-with-saml` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| SAMLProviderArn | string | no | The Alibaba Cloud Resource Name (ARN) of the SAML IdP that is created in RAM. Format: `acs:ram:: :saml-provider/ `. You can view the ARN… |
| RoleArn | string | no | The ARN of the RAM role to assume. The trusted entity of the RAM role is a SAML IdP. For more information, see… |
| SAMLAssertion | string | no | The Base64-encoded SAML assertion. The value must be 4 to 100,000 characters in length. Obtain the complete SAML response from the IdP. Do… |
| Policy | string | no | An access policy to further limit the permissions of the STS token. This parameter works as follows: If you specify this policy, the… |
| DurationSeconds | integer | no | The expiration duration of the token. Unit: seconds. The minimum value is 900 seconds. The maximum value is the value of the… |

### A call to the GetCallerIdentity operation returns information about the identity of the current caller
`POST https://zieapi.vercel.app/v1/cloud:aliyun-sts/get-caller-identity` (byok)

### version
`POST https://zieapi.vercel.app/v1/cloud:aliyun-sts/version` (byok)

## Example
```
curl "https://zieapi.vercel.app/v1/cloud:aliyun-sts/assume-role" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Alibaba Cloud Security Token Service API?
Create a free Apizie key, then send POST https://zieapi.vercel.app/v1/cloud:aliyun-sts/assume-role with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Alibaba Cloud Security Token Service API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Alibaba Cloud Security Token Service itself also needs your own key from aliyuncs.com.

### Can AI agents use the Alibaba Cloud Security Token Service API?
Yes. Add the Apizie MCP server (https://zieapi.vercel.app/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:aliyun-sts.

### What is the status of the Alibaba Cloud Security Token Service API?
Needs your own provider key (bring your own key)