2017/09/15 - Amazon API Gateway - 4 updated api methods
Changes
Add a new enum "REQUEST" to '--type
{'type': ['REQUEST']}
Adds a new Authorizer resource to an existing RestApi resource.
See also: AWS API Documentation
Request Syntax
client.create_authorizer(
restApiId='string',
name='string',
type='TOKEN'|'REQUEST'|'COGNITO_USER_POOLS',
providerARNs=[
'string',
],
authType='string',
authorizerUri='string',
authorizerCredentials='string',
identitySource='string',
identityValidationExpression='string',
authorizerResultTtlInSeconds=123
)
string
[REQUIRED]
The string identifier of the associated RestApi .
string
[REQUIRED]
[Required] The name of the authorizer.
string
[REQUIRED]
[Required] The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.
list
A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id} . For a TOKEN or REQUEST authorizer, this is not defined.
(string) --
string
Optional customer-defined field, used in Swagger imports and exports without functional impact.
string
Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations . In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api} , where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial / . For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations .
string
Specifies the required credentials as an IAM role for Amazon API Gateway to invoke the authorizer. To specify an IAM role for Amazon API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.
string
The identity source for which authorization is requested.
For a TOKEN authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth , the header mapping expression is method.request.header.Auth .
For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name . These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.
For a COGNITO_USER_POOLS authorizer, this property is not used.
string
A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. Amazon API Gateway will match the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.
integer
The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.
dict
Response Syntax
{
'id': 'string',
'name': 'string',
'type': 'TOKEN'|'REQUEST'|'COGNITO_USER_POOLS',
'providerARNs': [
'string',
],
'authType': 'string',
'authorizerUri': 'string',
'authorizerCredentials': 'string',
'identitySource': 'string',
'identityValidationExpression': 'string',
'authorizerResultTtlInSeconds': 123
}
Response Structure
(dict) --
Represents an authorization layer for methods. If enabled on a method, API Gateway will activate the authorizer when a client calls the method.
id (string) --
The identifier for the authorizer resource.
name (string) --
[Required] The name of the authorizer.
type (string) --
[Required] The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.
providerARNs (list) --
A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id} . For a TOKEN or REQUEST authorizer, this is not defined.
(string) --
authType (string) --
Optional customer-defined field, used in Swagger imports and exports without functional impact.
authorizerUri (string) --
Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations . In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api} , where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial / . For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations .
authorizerCredentials (string) --
Specifies the required credentials as an IAM role for Amazon API Gateway to invoke the authorizer. To specify an IAM role for Amazon API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.
identitySource (string) --
The identity source for which authorization is requested.
For a TOKEN authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth , the header mapping expression is method.request.header.Auth .
For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name . These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.
For a COGNITO_USER_POOLS authorizer, this property is not used.
identityValidationExpression (string) --
A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. Amazon API Gateway will match the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.
authorizerResultTtlInSeconds (integer) --
The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.
{'type': ['REQUEST']}
Describe an existing Authorizer resource.
See also: AWS API Documentation
Request Syntax
client.get_authorizer(
restApiId='string',
authorizerId='string'
)
string
[REQUIRED]
The string identifier of the associated RestApi .
string
[REQUIRED]
The identifier of the Authorizer resource.
dict
Response Syntax
{
'id': 'string',
'name': 'string',
'type': 'TOKEN'|'REQUEST'|'COGNITO_USER_POOLS',
'providerARNs': [
'string',
],
'authType': 'string',
'authorizerUri': 'string',
'authorizerCredentials': 'string',
'identitySource': 'string',
'identityValidationExpression': 'string',
'authorizerResultTtlInSeconds': 123
}
Response Structure
(dict) --
Represents an authorization layer for methods. If enabled on a method, API Gateway will activate the authorizer when a client calls the method.
id (string) --
The identifier for the authorizer resource.
name (string) --
[Required] The name of the authorizer.
type (string) --
[Required] The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.
providerARNs (list) --
A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id} . For a TOKEN or REQUEST authorizer, this is not defined.
(string) --
authType (string) --
Optional customer-defined field, used in Swagger imports and exports without functional impact.
authorizerUri (string) --
Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations . In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api} , where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial / . For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations .
authorizerCredentials (string) --
Specifies the required credentials as an IAM role for Amazon API Gateway to invoke the authorizer. To specify an IAM role for Amazon API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.
identitySource (string) --
The identity source for which authorization is requested.
For a TOKEN authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth , the header mapping expression is method.request.header.Auth .
For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name . These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.
For a COGNITO_USER_POOLS authorizer, this property is not used.
identityValidationExpression (string) --
A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. Amazon API Gateway will match the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.
authorizerResultTtlInSeconds (integer) --
The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.
{'items': {'type': ['REQUEST']}}
Describe an existing Authorizers resource.
See also: AWS API Documentation
Request Syntax
client.get_authorizers(
restApiId='string',
position='string',
limit=123
)
string
[REQUIRED]
The string identifier of the associated RestApi .
string
The current pagination position in the paged result set.
integer
The maximum number of returned results per page.
dict
Response Syntax
{
'position': 'string',
'items': [
{
'id': 'string',
'name': 'string',
'type': 'TOKEN'|'REQUEST'|'COGNITO_USER_POOLS',
'providerARNs': [
'string',
],
'authType': 'string',
'authorizerUri': 'string',
'authorizerCredentials': 'string',
'identitySource': 'string',
'identityValidationExpression': 'string',
'authorizerResultTtlInSeconds': 123
},
]
}
Response Structure
(dict) --
Represents a collection of Authorizer resources.
position (string) --
items (list) --
The current page of elements from this collection.
(dict) --
Represents an authorization layer for methods. If enabled on a method, API Gateway will activate the authorizer when a client calls the method.
id (string) --
The identifier for the authorizer resource.
name (string) --
[Required] The name of the authorizer.
type (string) --
[Required] The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.
providerARNs (list) --
A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id} . For a TOKEN or REQUEST authorizer, this is not defined.
(string) --
authType (string) --
Optional customer-defined field, used in Swagger imports and exports without functional impact.
authorizerUri (string) --
Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations . In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api} , where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial / . For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations .
authorizerCredentials (string) --
Specifies the required credentials as an IAM role for Amazon API Gateway to invoke the authorizer. To specify an IAM role for Amazon API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.
identitySource (string) --
The identity source for which authorization is requested.
For a TOKEN authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth , the header mapping expression is method.request.header.Auth .
For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name . These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.
For a COGNITO_USER_POOLS authorizer, this property is not used.
identityValidationExpression (string) --
A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. Amazon API Gateway will match the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.
authorizerResultTtlInSeconds (integer) --
The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.
{'type': ['REQUEST']}
Updates an existing Authorizer resource.
See also: AWS API Documentation
Request Syntax
client.update_authorizer(
restApiId='string',
authorizerId='string',
patchOperations=[
{
'op': 'add'|'remove'|'replace'|'move'|'copy'|'test',
'path': 'string',
'value': 'string',
'from': 'string'
},
]
)
string
[REQUIRED]
The string identifier of the associated RestApi .
string
[REQUIRED]
The identifier of the Authorizer resource.
list
A list of update operations to be applied to the specified resource and in the order specified in this list.
(dict) -- A single patch operation to apply to the specified resource. Please refer to http://tools.ietf.org/html/rfc6902#section-4 for an explanation of how each operation is used.
op (string) --
An update operation to be performed with this PATCH request. The valid value can be "add", "remove", or "replace". Not all valid operations are supported for a given resource. Support of the operations depends on specific operational contexts. Attempts to apply an unsupported operation on a resource will return an error message.
path (string) --
The op operation's target, as identified by a JSON Pointer value that references a location within the targeted resource. For example, if the target resource has an updateable property of {"name":"value"} , the path for this property is /name . If the name property value is a JSON object (e.g., {"name": {"child/name": "child-value"}} ), the path for the child/name property will be /name/child~1name . Any slash ("/") character appearing in path names must be escaped with "~1", as shown in the example above. Each op operation can have only one path associated with it.
value (string) --
The new target value of the update operation. When using AWS CLI to update a property of a JSON value, enclose the JSON object with a pair of single quotes in a Linux shell, e.g., '{"a": ...}'. In a Windows shell, see Using JSON for Parameters .
from (string) --
Not supported.
dict
Response Syntax
{
'id': 'string',
'name': 'string',
'type': 'TOKEN'|'REQUEST'|'COGNITO_USER_POOLS',
'providerARNs': [
'string',
],
'authType': 'string',
'authorizerUri': 'string',
'authorizerCredentials': 'string',
'identitySource': 'string',
'identityValidationExpression': 'string',
'authorizerResultTtlInSeconds': 123
}
Response Structure
(dict) --
Represents an authorization layer for methods. If enabled on a method, API Gateway will activate the authorizer when a client calls the method.
id (string) --
The identifier for the authorizer resource.
name (string) --
[Required] The name of the authorizer.
type (string) --
[Required] The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.
providerARNs (list) --
A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id} . For a TOKEN or REQUEST authorizer, this is not defined.
(string) --
authType (string) --
Optional customer-defined field, used in Swagger imports and exports without functional impact.
authorizerUri (string) --
Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations . In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api} , where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial / . For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations .
authorizerCredentials (string) --
Specifies the required credentials as an IAM role for Amazon API Gateway to invoke the authorizer. To specify an IAM role for Amazon API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.
identitySource (string) --
The identity source for which authorization is requested.
For a TOKEN authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth , the header mapping expression is method.request.header.Auth .
For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name . These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.
For a COGNITO_USER_POOLS authorizer, this property is not used.
identityValidationExpression (string) --
A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. Amazon API Gateway will match the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.
authorizerResultTtlInSeconds (integer) --
The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.