Obtaining a Temporary AK/SK

Function

URI

Request Parameters

• Parameters in the request header
  • Obtaining a temporary AK/SK with an agency token (methods is set to assume_role)

    Parameter	Mandatory	Type	Description
    X-Auth-Token	Yes	String	Token with permissions of the Agent Operator policy.
    Content-Type	Yes	String	Fill application/json;charset=utf8 in this field.

  • Obtaining a temporary AK/SK with a user token or a federated token (methods is set to token)

    Parameter	Mandatory	Type	Description
    Content-Type	Yes	String	Fill application/json;charset=utf8 in this field.
    X-Auth-Token	No	String	User token or federated token required for obtaining a temporary AK/SK. You need to specify either this parameter or the token ID in the request body. This parameter takes the precedence.

  • Parameters in the request body

    Name	Type	Mandatory	Description
    auth	TokenAuth object	Yes	Authentication information.

  • auth

    Name	Type	Mandatory	Description
    identity	TokenAuthIdentity object	Yes	Authentication parameters.

  • auth.identity

    Name	Type	Mandatory	Description
    methods	Array of strings	Yes	Authentication method. The value of this parameter is ["token"].
    token	IdentityToken object	No	IAM user token, federated user token, or agency token. The id in this parameter is the same as that of X-Auth-Token in the request header. This parameter is to be discarded.
    policy	ServicePolicy object	No	Content of the custom policy.

  • auth.identity.token

    Name	Type	Mandatory	Description
    id	string	No	Token ID. Same as the X-Auth-Token in the request header. This parameter is to be discarded.
    duration_seconds	integer	No	Validity period (in seconds) of an AK/SK and security token. The value ranges from 15 minutes to 24 hours. The default value is 15min.

  • auth.identity.policy

    Name	Type	Mandatory	Description
    Version	string	Yes	Policy version. When creating a custom policy, set this parameter to 1.1. 1.0: System-defined role. Only a limited number of service-level roles are provided for authorization. 1.1: Policy. A policy defines the permissions required to perform actions on a specific cloud resource under certain conditions.
    Statement	Array of ServiceStatement objects	Yes	Statement of the policy, which describes details of a custom policy.

  • auth.identity.policy.Statement

    Name	Type	Mandatory	Description
    Action	Array of strings	Yes	Specific operation permissions on a resource. Format: Service name:Resource type:Action, for example, vpc:ports:create Service name: indicates the service name, such as ecs, evs, or vpc. Only lowercase letters are allowed. Resource types and actions are not case-sensitive. You can use an asterisk (*) to represent all actions.
    Effect	string	Yes	Effect of the permission. The value can be Allow or Deny. If both Allow and Deny statements are found in a policy, the authentication starts from the Deny statements.
    Condition	Map<String,Map<String,Array<String>>>	No	Conditions for the permission to take effect. NOTE: Take the condition in the sample request as an example, the values of the condition key (obs:prefix) and string (public) must be equal (StringEquals). "Condition": { "StringEquals": { "obs:prefix": [ "public" ] } }
    Resource	Object	No	Cloud resource. The rules are as follows: The five-segment format can contain an asterisk (*): <service-name>:<region>:<account-id>:<resource-type>:<resource-path>, for example, obs:::bucket:*. The region segment can be * or a region accessible to the user. The service must exist and the specified resource must belong to the service.

  • Obtaining a temporary AK/SK with an agency token (methods is set to assume_role)

    Parameter	Mandatory	Type	Description
    methods	Mandatory	String Array	Fill assume_role in this field.
    agency_name	Mandatory	String	Name of the agency created by a delegating party.
    domain_name or domain_id	Mandatory	String	domain.name: Name of the domain which the delegating party belongs to.
    duration_seconds	No	Int	Validity period (in seconds) of an AK/SK and security token. The value ranges from 15 minutes to 24 hours. The default value is 15 minutes.
    scope	No	Object	AK/SK and security token. If this parameter is left blank, the generated security token does not contain the scope information. You are advised to leave this parameter blank. To set the scope of the temporary AK/SK and security token, specify a project or domain. If this field is set to project, the temporary AK/SK and security token can only be used to access resources in the project of a specified ID or name. "scope": { "project": { "id": "0b95b78b67fa045b38104c12fb..." } } If this field is set to domain, the temporary AK/SK and security token can be used to access all resources under the domain of a specified ID or name. "scope": { "domain": { "name": " domain A" } }

  • Obtaining a temporary AK/SK with a user token or a federated token (methods is set to token)

    Parameter	Mandatory	Type	Description
    methods	Mandatory	String Array	Fill token in this field.
    token	No	JSON object	Common token or federated token required for obtaining a temporary AK/SK. You need to choose either the ID in this object or X-Auth-Token in the request header. X-Auth-Token takes priority over the ID in this object.
    duration_seconds	No	Int	Validity period (in seconds) of an AK/SK and security token. The value ranges from 15 minutes to 24 hours. The default value is 15 minutes.

• Example request
  • When the methods parameter is set to assume_role

    {
        "auth": {
            "identity": {
                "methods": [
                    "assume_role"
                ],
                "assume_role": {
                    "domain_id": "411edb4b634144f587ffc88f9bbdxxx",
                    "xrole_name": "testagency",
                    "duration_seconds": 3600
                }
            }
        }
    }
    
    
    

  • When the methods parameter is set to token

    {
        "auth": {
            "identity": {
                "methods": [
                    "token"
                ],
                "token": {
                    "id": "MIIDkgYJKoZIhvcNAQcCoIIDgzCCA38CAQExDTALBglghkgBZQMEAgEwgXXXXX...",
                    "duration_seconds": 900
                }
            }
        }
    }
    
    

Response Parameters

• Parameters in the response body

  Parameter	Mandatory	Type	Description
  credential	Mandatory	Object	Authentication information.

• credential

  Parameter	Mandatory	Type	Description
  expires_at	Mandatory	String	Expiration time.
  access	Mandatory	String	AK.
  secret	Mandatory	String	SK.
  securitytoken	Mandatory	String	Used for subsequent replacement of an SK or token.

• Example response

  {
    "credential": {
      "access": "NQC51NFINJS1JXX...",
      "secret": "EY74MByPZ46kTRJL9ay5DskqXX...",
      "expires_at": "2017-04-17T07:55:18.575000Z",
      "securitytoken": "gAAAAABY9GbWUaGtoa9DPj7_dE4qUSnAXXX..."
    }
  }
  
  

Status Codes