{"files":{"SKILL.md":"---\nname: aws-single-sign-on\ndescription: \"AWS Single Sign-On API skill. Use when working with AWS Single Sign-On for federation, assignment, logout. Covers 4 endpoints.\"\nversion: 1.0.0\ngenerator: lapsh\n---\n\n# AWS Single Sign-On\nAPI version: 2019-06-10\n\n## Auth\nAWS SigV4\n\n## Base URL\nNot specified.\n\n## Setup\n1. Configure auth: AWS SigV4\n2. GET /federation/credentials -- returns the sts short-term credentials for a given role name that is assigned to the user.\n3. POST /logout -- create first logout\n\n## Endpoints\n4 endpoints across 3 groups. See references/api-spec.lap for full details.\n\n### Federation\n| Method | Path | Description |\n|--------|------|-------------|\n| GET | /federation/credentials | Returns the STS short-term credentials for a given role name that is assigned to the user. |\n\n### Assignment\n| Method | Path | Description |\n|--------|------|-------------|\n| GET | /assignment/roles | Lists all roles that are assigned to the user for a given AWS account. |\n| GET | /assignment/accounts | Lists all AWS accounts assigned to the user. These AWS accounts are assigned by the administrator of the account. For more information, see Assign User Access in the IAM Identity Center User Guide. This operation returns a paginated response. |\n\n### Logout\n| Method | Path | Description |\n|--------|------|-------------|\n| POST | /logout | Removes the locally stored SSO tokens from the client-side cache and sends an API call to the IAM Identity Center service to invalidate the corresponding server-side IAM Identity Center sign in session.  If a user uses IAM Identity Center to access the AWS CLI, the user’s IAM Identity Center sign in session is used to obtain an IAM session, as specified in the corresponding IAM Identity Center permission set. More specifically, IAM Identity Center assumes an IAM role in the target account on behalf of the user, and the corresponding temporary AWS credentials are returned to the client. After user logout, any existing IAM role sessions that were created by using IAM Identity Center permission sets continue based on the duration configured in the permission set. For more information, see User authentications in the IAM Identity Center User Guide. |\n\n## Common Questions\nMatch user requests to endpoints in references/api-spec.lap. Key patterns:\n- \"List all credentials?\" -> GET /federation/credentials\n- \"List all roles?\" -> GET /assignment/roles\n- \"List all accounts?\" -> GET /assignment/accounts\n- \"Create a logout?\" -> POST /logout\n- \"How to authenticate?\" -> See Auth section above\n\n## Response Tips\n- Check response schemas in references/api-spec.lap for field details\n- Create/update endpoints return the modified resource on success\n\n## References\n- Full spec: See references/api-spec.lap for complete endpoint details, parameter tables, and response schemas\n\n> Generated from the official API spec by [LAP](https://lap.sh)\n","references/api-spec.lap":"@lap v0.3\n# Machine-readable API spec. Each @endpoint block is one API call.\n@api AWS Single Sign-On\n@version 2019-06-10\n@auth AWS SigV4\n@endpoints 4\n@toc federation(1), assignment(2), logout(1)\n\n@group federation\n@endpoint GET /federation/credentials\n@desc Returns the STS short-term credentials for a given role name that is assigned to the user.\n@required {role_name: str, account_id: str, x-amz-sso_bearer_token: str}\n@returns(200) {roleCredentials: RoleCredentials?{accessKeyId: str?, secretAccessKey: str?, sessionToken: str?, expiration: int(i64)?}}\n\n@endgroup\n\n@group assignment\n@endpoint GET /assignment/roles\n@desc Lists all roles that are assigned to the user for a given AWS account.\n@required {x-amz-sso_bearer_token: str, account_id: str}\n@optional {next_token: str, max_result: int}\n@returns(200) {nextToken: str?, roleList: [RoleInfo]?}\n\n@endpoint GET /assignment/accounts\n@desc Lists all AWS accounts assigned to the user. These AWS accounts are assigned by the administrator of the account. For more information, see Assign User Access in the IAM Identity Center User Guide. This operation returns a paginated response.\n@required {x-amz-sso_bearer_token: str}\n@optional {next_token: str, max_result: int}\n@returns(200) {nextToken: str?, accountList: [AccountInfo]?}\n\n@endgroup\n\n@group logout\n@endpoint POST /logout\n@desc Removes the locally stored SSO tokens from the client-side cache and sends an API call to the IAM Identity Center service to invalidate the corresponding server-side IAM Identity Center sign in session.  If a user uses IAM Identity Center to access the AWS CLI, the user’s IAM Identity Center sign in session is used to obtain an IAM session, as specified in the corresponding IAM Identity Center permission set. More specifically, IAM Identity Center assumes an IAM role in the target account on behalf of the user, and the corresponding temporary AWS credentials are returned to the client. After user logout, any existing IAM role sessions that were created by using IAM Identity Center permission sets continue based on the duration configured in the permission set. For more information, see User authentications in the IAM Identity Center User Guide.\n@required {x-amz-sso_bearer_token: str}\n\n@endgroup\n\n@end\n"}}