# AWS Single Sign-On Admin API

> AWS Single Sign-On Admin API on Apizie: 37 endpoints (Attaches the specified customer managed policy to the specified PermissionSet ., Attaches an AWS managed policy ARN to a permission set. If the permission set is already referenced by one…, Assigns access to a principal for a specified AWS account using a specified permission set. The term…, Enables the attributes-based access control (ABAC) feature for the specified IAM Identity Center instance.…, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:amazonaws-sso-admin`
- Category: Cloud
- Status: byok
- Source: https://github.com/mermade/aws2openapi
- Page: https://zieapi.vercel.app/api/cloud/amazonaws-sso-admin
- OpenAPI: https://zieapi.vercel.app/api/cloud/amazonaws-sso-admin/openapi.json

AWS IAM Identity Center (successor to AWS Single Sign-On) helps you securely create, or connect, your workforce identities and manage their access centrally across AWS accounts and applications. IAM Identity Center is…

## Endpoints

### Attaches the specified customer managed policy to the specified PermissionSet .
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/attach-customer-managed-policy-reference-to-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Attaches an AWS managed policy ARN to a permission set. If the permission set is already referenced by one…
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/attach-managed-policy-to-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Assigns access to a principal for a specified AWS account using a specified permission set. The term…
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/create-account-assignment` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Enables the attributes-based access control (ABAC) feature for the specified IAM Identity Center instance.…
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/create-instance-access-control-attribute-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Creates a permission set within a specified IAM Identity Center instance. To grant users and groups access…
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/create-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Deletes a principal's access from a specified AWS account using a specified permission set. After a…
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/delete-account-assignment` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Deletes the inline policy from a specified permission set.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/delete-inline-policy-from-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Disables the attributes-based access control (ABAC) feature for the specified IAM Identity Center instance…
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/delete-instance-access-control-attribute-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Deletes the specified permission set.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/delete-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Deletes the permissions boundary from a specified PermissionSet .
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/delete-permissions-boundary-from-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Describes the status of the assignment creation request.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/describe-account-assignment-creation-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Describes the status of the assignment deletion request.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/describe-account-assignment-deletion-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Returns the list of IAM Identity Center identity store attributes that have been configured to work with…
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/describe-instance-access-control-attribute-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Gets the details of the permission set.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/describe-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Describes the status for the given permission set provisioning request.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/describe-permission-set-provisioning-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Detaches the specified customer managed policy from the specified PermissionSet .
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/detach-customer-managed-policy-reference-from-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Detaches the attached AWS managed policy ARN from the specified permission set.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/detach-managed-policy-from-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Obtains the inline policy assigned to the permission set.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/get-inline-policy-for-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Obtains the permissions boundary for a specified PermissionSet .
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/get-permissions-boundary-for-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Lists the status of the AWS account assignment creation requests for a specified IAM Identity Center instance.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/list-account-assignment-creation-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| MaxResults | integer | no | Pagination limit |
| NextToken | string | no | Pagination token |
| body | object | no | JSON request body |

### Lists the status of the AWS account assignment deletion requests for a specified IAM Identity Center instance.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/list-account-assignment-deletion-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| MaxResults | integer | no | Pagination limit |
| NextToken | string | no | Pagination token |
| body | object | no | JSON request body |

### Lists the assignee of the specified AWS account with the specified permission set.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/list-account-assignments` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| MaxResults | integer | no | Pagination limit |
| NextToken | string | no | Pagination token |
| body | object | no | JSON request body |

### Lists all the AWS accounts where the specified permission set is provisioned.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/list-accounts-for-provisioned-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| MaxResults | integer | no | Pagination limit |
| NextToken | string | no | Pagination token |
| body | object | no | JSON request body |

### Lists all customer managed policies attached to a specified PermissionSet .
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/list-customer-managed-policy-references-in-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| MaxResults | integer | no | Pagination limit |
| NextToken | string | no | Pagination token |
| body | object | no | JSON request body |

### Lists the IAM Identity Center instances that the caller has access to.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/list-instances` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| MaxResults | integer | no | Pagination limit |
| NextToken | string | no | Pagination token |
| body | object | no | JSON request body |

### Lists the AWS managed policy that is attached to a specified permission set.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/list-managed-policies-in-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| MaxResults | integer | no | Pagination limit |
| NextToken | string | no | Pagination token |
| body | object | no | JSON request body |

### Lists the status of the permission set provisioning requests for a specified IAM Identity Center instance.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/list-permission-set-provisioning-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| MaxResults | integer | no | Pagination limit |
| NextToken | string | no | Pagination token |
| body | object | no | JSON request body |

### Lists the PermissionSet s in an IAM Identity Center instance.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/list-permission-sets` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| MaxResults | integer | no | Pagination limit |
| NextToken | string | no | Pagination token |
| body | object | no | JSON request body |

### Lists all the permission sets that are provisioned to a specified AWS account.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/list-permission-sets-provisioned-to-account` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| MaxResults | integer | no | Pagination limit |
| NextToken | string | no | Pagination token |
| body | object | no | JSON request body |

### Lists the tags that are attached to a specified resource.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/list-tags-for-resource` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| NextToken | string | no | Pagination token |
| body | object | no | JSON request body |

### The process by which a specified permission set is provisioned to the specified target.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/provision-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Attaches an inline policy to a permission set. If the permission set is already referenced by one or more…
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/put-inline-policy-to-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Attaches an AWS managed or customer managed policy to the specified PermissionSet as a permissions boundary.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/put-permissions-boundary-to-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Associates a set of tags with a specified resource.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/tag-resource` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Disassociates a set of tags from a specified resource.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/untag-resource` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Updates the IAM Identity Center identity store attributes that you can use with the IAM Identity Center…
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/update-instance-access-control-attribute-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

### Updates an existing permission set.
`POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/update-permission-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| region | string | no | The AWS region |
| body | object | no | JSON request body |

## Example
```
curl "https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/attach-customer-managed-policy-reference-to-permission-set" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the AWS Single Sign-On Admin API?
Create a free Apizie key, then send POST https://zieapi.vercel.app/v1/cloud:amazonaws-sso-admin/attach-customer-managed-policy-reference-to-permission-set with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the AWS Single Sign-On Admin API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. AWS Single Sign-On Admin itself also needs your own key from amazonaws.com.

### Can AI agents use the AWS Single Sign-On Admin API?
Yes. Add the Apizie MCP server (https://zieapi.vercel.app/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:amazonaws-sso-admin.

### What is the status of the AWS Single Sign-On Admin API?
Needs your own provider key (bring your own key)