2026/08/25 - AWS DevOps Agent Service - 1 new 17 updated api methods
Changes Adds the UpdateApprovalAction API for resolving agent action approvals in AWS DevOps Agent agent spaces.
Updates an approval request with the terminal decision (APPROVED or REJECTED). A single operation handles both verbs via the action enum.
See also: AWS API Documentation
Request Syntax
client.update_approval_action(
agentSpaceId='string',
approvalId='string',
action='APPROVED'|'REJECTED',
finalPattern={
'tool': 'string',
'argumentPins': {
'string': 'string'
}
},
reason='string',
ttlSeconds=123,
singleUse=True|False
)
string
[REQUIRED]
The agent space identifier — multi-tenant workspace scope. Bound from the request URI.
string
[REQUIRED]
Identifier of the approval request being resolved. A UUID. Bound from the request URI.
string
[REQUIRED]
The action to take on the approval request — APPROVED or REJECTED.
dict
The finalized pattern (tool + argumentPins) that scopes the approval. Required when action is APPROVED; must be absent when action is REJECTED. The pattern narrows, and must not widen, the invocation originally requested by the agent. This cross-field invariant is enforced by service-side validation.
tool (string) -- [REQUIRED]
Identifier of the tool the pattern applies to (e.g. use_aws for AWS actions, or a third-party tool name).
argumentPins (dict) -- [REQUIRED]
Argument constraints that narrow which tool invocations the pattern matches. For AWS tools, the map must include operation (the IAM action, e.g. ec2:AuthorizeSecurityGroupIngress) and resource_arn (the resource ARN or ARN glob); additional narrowing arguments go in further pin keys. The same {tool, argumentPins} shape is used uniformly for AWS and third-party tools, with tool-specific keys for third-party tools. Requests whose argument pins are collectively too large are rejected with a ValidationException.
(string) --
Argument pin key in an ApprovalPattern (e.g. operation, resource_arn).
(string) --
Argument pin value in an ApprovalPattern.
string
Optional free-text rationale for the decision. Permitted when action is REJECTED; ignored when action is APPROVED.
integer
Approval lifetime in seconds, starting from when the decision is submitted. Required when action is APPROVED AND singleUse is false; must be absent when action is REJECTED or when singleUse is true (a single-use approval backs one executed action and the redemption window collapses). Cross-field invariants are enforced by service-side validation; the @range bound here is the operation-boundary check that always applies (a maximum of 4 hours).
boolean
Whether the approved action backs a single executed tool call (true) or is reusable within ttlSeconds (false). Required when action is APPROVED; must be absent when action is REJECTED. When true, ttlSeconds must be absent (the redemption window collapses to the single use). When false, ttlSeconds is required and bounds the reuse window. Cross-field invariants are enforced by service-side validation.
dict
Response Syntax
{
'approvalId': 'string',
'status': 'PENDING'|'APPROVED'|'REJECTED'|'REVOKED'|'REDEEMED',
'expiresAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
Response structure for UpdateApprovalAction. Reports the post-submission lifecycle status of the approval request and, when applicable, the absolute expiry timestamp. The status is a lifecycle state distinct from the action verb — an APPROVED submission transitions the request to APPROVED status (live, redeemable); a REJECTED submission transitions it to REJECTED status (terminal).
approvalId (string) --
Identifier of the approval request that was resolved. Echoed back so the client can correlate the response with the request.
status (string) --
Lifecycle status of the approval request immediately after submission. Expected post-submission states are APPROVED (when the action is APPROVED) or REJECTED (when the action is REJECTED); PENDING is not returned from this operation, and REVOKED and REDEEMED are reachable only via subsequent reads.
expiresAt (datetime) --
Absolute timestamp at which the approval expires. Set when status is APPROVED (computed as the submission time plus ttlSeconds); absent when status is REJECTED.
{'configuration': {'aws': {'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid | invalid | '
'pending-confirmation'},
'mcpserver': {'toolDetails': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpserverdatadog': {'enabledElevatedTools': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpservergrafana': {'enabledElevatedTools': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpserversigv4': {'toolDetails': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'sourceAws': {'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid | '
'invalid | '
'pending-confirmation'}}}
Response {'association': {'configuration': {'aws': {'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid '
'| '
'invalid '
'| '
'pending-confirmation'},
'mcpserver': {'toolDetails': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpserverdatadog': {'enabledElevatedTools': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpservergrafana': {'enabledElevatedTools': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpserversigv4': {'toolDetails': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'sourceAws': {'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid '
'| '
'invalid '
'| '
'pending-confirmation'}}}}
Adds a specific service association to an AgentSpace. It overwrites the existing association of the same service. Returns 201 Created on success.
See also: AWS API Documentation
Request Syntax
client.associate_service(
agentSpaceId='string',
serviceId='string',
configuration={
'sourceAws': {
'accountId': 'string',
'accountType': 'source',
'assumableRoleArn': 'string',
'externalId': 'string',
'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid'|'invalid'|'pending-confirmation'
},
'aws': {
'assumableRoleArn': 'string',
'accountId': 'string',
'accountType': 'monitor',
'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid'|'invalid'|'pending-confirmation'
},
'github': {
'repoName': 'string',
'repoId': 'string',
'owner': 'string',
'ownerType': 'organization'|'user',
'instanceIdentifier': 'string',
'runtimeRoleArn': 'string'
},
'slack': {
'workspaceId': 'string',
'workspaceName': 'string',
'transmissionTarget': {
'opsOncallTarget': {
'channelName': 'string',
'channelId': 'string'
},
'opsSRETarget': {
'channelName': 'string',
'channelId': 'string'
}
}
},
'dynatrace': {
'envId': 'string',
'resources': [
'string',
]
},
'servicenow': {
'instanceId': 'string',
'authScopes': [
'string',
]
},
'mcpservernewrelic': {
'accountId': 'string',
'endpoint': 'string'
},
'mcpserverdatadog': {
'enabledElevatedTools': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'mcpserver': {
'tools': [
'string',
],
'toolDetails': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'gitlab': {
'projectId': 'string',
'projectPath': 'string',
'instanceIdentifier': 'string',
'runtimeRoleArn': 'string'
},
'mcpserversplunk': {}
,
'eventChannel': {}
,
'azure': {
'subscriptionId': 'string'
},
'azuredevops': {
'organizationName': 'string',
'projectId': 'string',
'projectName': 'string'
},
'mcpservergrafana': {
'endpoint': 'string',
'organizationId': 'string',
'tools': [
'string',
],
'enabledElevatedTools': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'pagerduty': {
'services': [
'string',
],
'customerEmail': 'string'
},
'mcpserversigv4': {
'tools': [
'string',
],
'toolDetails': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'remoteagent': {}
,
'remoteagentsigv4': {}
},
capabilities={
'string': {
'enabled': True|False
}
}
)
string
[REQUIRED]
The unique identifier of the AgentSpace
string
[REQUIRED]
The unique identifier of the service.
dict
[REQUIRED]
The configuration that directs how AgentSpace interacts with the given service.
sourceAws (dict) --
AWS source account configuration for monitoring resources.
accountId (string) -- [REQUIRED]
AWS Account Id corresponding to provided resources.
accountType (string) -- [REQUIRED]
Account Type 'source' for AIDevOps monitoring.
assumableRoleArn (string) -- [REQUIRED]
Role ARN to be assumed by AIDevOps to operate on behalf of customer. To set this role ARN on AssociateService or UpdateAssociation, the caller must have at least the iam:PassRole permission on arn:aws:iam::<account-id>:role/* in the caller's own account, with the condition iam:PassedToService set to aidevops.amazonaws.com. A broader iam:PassRole grant also satisfies this requirement.
externalId (string) --
External ID for additional security when assuming the role. Used to prevent the confused deputy problem.
agentElevatedRoleArn (string) --
Optional IAM role ARN to be assumed by AIDevOps for elevated directed actions on behalf of the customer. Used for mutating operations gated by elevatedActionsEnabled on the AgentSpace. When not provided, only non-elevated directed actions are available for this AWS account. Setting this role is subject to the same minimum iam:PassRole requirement described on assumableRoleArn.
agentElevatedRoleArnStatus (string) --
Validation status of the agentElevatedRoleArn. Updated asynchronously after the customer registers an elevated role. Possible values: PENDING_CONFIRMATION (validation in progress), VALID (role validated), INVALID (validation failed).
aws (dict) --
AWS monitor account configuration.
assumableRoleArn (string) -- [REQUIRED]
Role ARN to be assumed by AIDevOps to operate on behalf of customer.
accountId (string) -- [REQUIRED]
AWS Account Id corresponding to provided resources.
accountType (string) -- [REQUIRED]
Account Type 'monitor' for AIDevOps monitoring.
agentElevatedRoleArn (string) --
Optional IAM role ARN to be assumed by AIDevOps for elevated directed actions on behalf of the customer. Used for mutating operations gated by elevatedActionsEnabled on the AgentSpace. When not provided, only non-elevated directed actions are available for this AWS account.
agentElevatedRoleArnStatus (string) --
Validation status of the agentElevatedRoleArn. Updated asynchronously after the customer registers an elevated role. Possible values: PENDING_CONFIRMATION (validation in progress), VALID (role validated), INVALID (validation failed).
github (dict) --
GitHub repository integration configuration.
repoName (string) -- [REQUIRED]
Associated Github repo name
repoId (string) -- [REQUIRED]
Associated Github repo ID
owner (string) -- [REQUIRED]
The GitHub repository owner name.
ownerType (string) -- [REQUIRED]
Type of GitHub repository owner.
instanceIdentifier (string) --
GitHub instance identifier (e.g., github.com or github.enterprise.com)
runtimeRoleArn (string) --
Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
slack (dict) --
Slack workspace integration configuration.
workspaceId (string) -- [REQUIRED]
Associated Slack workspace ID
workspaceName (string) -- [REQUIRED]
Associated Slack workspace name
transmissionTarget (dict) -- [REQUIRED]
Transmission targets for agent notifications
opsOncallTarget (dict) -- [REQUIRED]
Destination for On-call Agent (Ops1)
channelName (string) --
Slack channel name
channelId (string) -- [REQUIRED]
Slack channel ID
opsSRETarget (dict) --
Destination for SRE Agent (Ops1.5)
channelName (string) --
Slack channel name
channelId (string) -- [REQUIRED]
Slack channel ID
dynatrace (dict) --
Dynatrace monitoring integration configuration.
envId (string) -- [REQUIRED]
Dynatrace environment id
resources (list) --
List of Dynatrace resources to monitor
(string) --
servicenow (dict) --
ServiceNow instance integration configuration.
instanceId (string) --
ServiceNow instance ID
authScopes (list) --
Scoped down authentication scopes for fine grained control
(string) --
mcpservernewrelic (dict) --
NewRelic instance integration configuration.
accountId (string) -- [REQUIRED]
New Relic Account ID
endpoint (string) -- [REQUIRED]
MCP server endpoint URL (e.g., https://mcp.newrelic.com/mcp/)
mcpserverdatadog (dict) --
Datadog MCP server integration configuration.
enabledElevatedTools (list) --
The subset of elevated-access tools enabled for this integration.
(dict) --
An MCP tool together with its access categorization.
name (string) -- [REQUIRED]
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
mcpserver (dict) --
MCP (Model Context Protocol) server integration configuration.
tools (list) -- [REQUIRED]
List of MCP tools can be used with the association.
(string) --
toolDetails (list) --
List of MCP tools with their access categorization. When provided, the tool names must match those in the tools member.
(dict) --
An MCP tool together with its access categorization.
name (string) -- [REQUIRED]
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
gitlab (dict) --
GitLab project integration configuration.
projectId (string) -- [REQUIRED]
GitLab numeric project ID.
projectPath (string) -- [REQUIRED]
Full GitLab project path (e.g., namespace/project-name).
instanceIdentifier (string) --
GitLab instance identifier (e.g., gitlab.com or e2e.gamma.dev.us-east-1.gitlab.falco.ai.aws.dev)
runtimeRoleArn (string) --
Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
mcpserversplunk (dict) --
Splunk MCP server integration configuration.
eventChannel (dict) --
Event Channel instance integration configuration.
azure (dict) --
Azure subscription integration configuration.
subscriptionId (string) -- [REQUIRED]
Azure subscription ID corresponding to provided resources.
azuredevops (dict) --
Azure DevOps project integration configuration.
organizationName (string) -- [REQUIRED]
Azure DevOps organization name.
projectId (string) -- [REQUIRED]
Azure DevOps project ID.
projectName (string) -- [REQUIRED]
Azure DevOps project name.
mcpservergrafana (dict) --
Grafana MCP server integration configuration.
endpoint (string) -- [REQUIRED]
Grafana instance URL (e.g., https://your-instance.grafana.net)
organizationId (string) --
The Grafana organization ID that can be used.
tools (list) --
List of MCP tools that can be used.
(string) --
enabledElevatedTools (list) --
The subset of elevated-access tools enabled for this integration.
(dict) --
An MCP tool together with its access categorization.
name (string) -- [REQUIRED]
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
pagerduty (dict) --
PagerDuty integration configuration
services (list) -- [REQUIRED]
List of Pagerduty service available for the association.
(string) --
customerEmail (string) -- [REQUIRED]
Email to be used in Pagerduty API header
mcpserversigv4 (dict) --
SigV4-authenticated MCP server integration configuration.
tools (list) -- [REQUIRED]
List of MCP tools available for the association.
(string) --
toolDetails (list) --
List of MCP tools with their access categorization. When provided, the tool names must match those in the tools member.
(dict) --
An MCP tool together with its access categorization.
name (string) -- [REQUIRED]
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
remoteagent (dict) --
Remote A2A agent integration configuration (token-based auth).
remoteagentsigv4 (dict) --
Remote A2A agent integration configuration (SigV4 auth).
dict
Enabled capabilities for this association.
(string) --
AWS DevOps Agent capability types representing the set of automated capabilities that can be enabled per association.
(dict) --
Capability configuration for the AWS DevOps Agent.
enabled (boolean) --
Whether the capability is enabled.
dict
Response Syntax
{
'association': {
'agentSpaceId': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'status': 'valid'|'invalid'|'pending-confirmation',
'associationId': 'string',
'serviceId': 'string',
'configuration': {
'sourceAws': {
'accountId': 'string',
'accountType': 'source',
'assumableRoleArn': 'string',
'externalId': 'string',
'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid'|'invalid'|'pending-confirmation'
},
'aws': {
'assumableRoleArn': 'string',
'accountId': 'string',
'accountType': 'monitor',
'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid'|'invalid'|'pending-confirmation'
},
'github': {
'repoName': 'string',
'repoId': 'string',
'owner': 'string',
'ownerType': 'organization'|'user',
'instanceIdentifier': 'string',
'runtimeRoleArn': 'string'
},
'slack': {
'workspaceId': 'string',
'workspaceName': 'string',
'transmissionTarget': {
'opsOncallTarget': {
'channelName': 'string',
'channelId': 'string'
},
'opsSRETarget': {
'channelName': 'string',
'channelId': 'string'
}
}
},
'dynatrace': {
'envId': 'string',
'resources': [
'string',
]
},
'servicenow': {
'instanceId': 'string',
'authScopes': [
'string',
]
},
'mcpservernewrelic': {
'accountId': 'string',
'endpoint': 'string'
},
'mcpserverdatadog': {
'enabledElevatedTools': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'mcpserver': {
'tools': [
'string',
],
'toolDetails': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'gitlab': {
'projectId': 'string',
'projectPath': 'string',
'instanceIdentifier': 'string',
'runtimeRoleArn': 'string'
},
'mcpserversplunk': {},
'eventChannel': {},
'azure': {
'subscriptionId': 'string'
},
'azuredevops': {
'organizationName': 'string',
'projectId': 'string',
'projectName': 'string'
},
'mcpservergrafana': {
'endpoint': 'string',
'organizationId': 'string',
'tools': [
'string',
],
'enabledElevatedTools': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'pagerduty': {
'services': [
'string',
],
'customerEmail': 'string'
},
'mcpserversigv4': {
'tools': [
'string',
],
'toolDetails': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'remoteagent': {},
'remoteagentsigv4': {}
},
'capabilities': {
'string': {
'enabled': True|False
}
}
},
'webhook': {
'webhookUrl': 'string',
'webhookId': 'string',
'webhookType': 'hmac'|'apikey'|'gitlab'|'pagerduty',
'webhookSecret': 'string',
'apiKey': 'string'
}
}
Response Structure
(dict) --
Output containing the newly created association and optional webhook configuration.
association (dict) --
Represents a service association within an AgentSpace, defining how the agent interacts with external services.
agentSpaceId (string) --
The unique identifier of the AgentSpace
createdAt (datetime) --
The timestamp when the resource was created.
updatedAt (datetime) --
The timestamp when the resource was last updated.
status (string) --
Validation status
associationId (string) --
The unique identifier of the given association.
serviceId (string) --
The identifier for associated service
configuration (dict) --
The configuration that directs how AgentSpace interacts with the given service.
sourceAws (dict) --
AWS source account configuration for monitoring resources.
accountId (string) --
AWS Account Id corresponding to provided resources.
accountType (string) --
Account Type 'source' for AIDevOps monitoring.
assumableRoleArn (string) --
Role ARN to be assumed by AIDevOps to operate on behalf of customer. To set this role ARN on AssociateService or UpdateAssociation, the caller must have at least the iam:PassRole permission on arn:aws:iam::<account-id>:role/* in the caller's own account, with the condition iam:PassedToService set to aidevops.amazonaws.com. A broader iam:PassRole grant also satisfies this requirement.
externalId (string) --
External ID for additional security when assuming the role. Used to prevent the confused deputy problem.
agentElevatedRoleArn (string) --
Optional IAM role ARN to be assumed by AIDevOps for elevated directed actions on behalf of the customer. Used for mutating operations gated by elevatedActionsEnabled on the AgentSpace. When not provided, only non-elevated directed actions are available for this AWS account. Setting this role is subject to the same minimum iam:PassRole requirement described on assumableRoleArn.
agentElevatedRoleArnStatus (string) --
Validation status of the agentElevatedRoleArn. Updated asynchronously after the customer registers an elevated role. Possible values: PENDING_CONFIRMATION (validation in progress), VALID (role validated), INVALID (validation failed).
aws (dict) --
AWS monitor account configuration.
assumableRoleArn (string) --
Role ARN to be assumed by AIDevOps to operate on behalf of customer.
accountId (string) --
AWS Account Id corresponding to provided resources.
accountType (string) --
Account Type 'monitor' for AIDevOps monitoring.
agentElevatedRoleArn (string) --
Optional IAM role ARN to be assumed by AIDevOps for elevated directed actions on behalf of the customer. Used for mutating operations gated by elevatedActionsEnabled on the AgentSpace. When not provided, only non-elevated directed actions are available for this AWS account.
agentElevatedRoleArnStatus (string) --
Validation status of the agentElevatedRoleArn. Updated asynchronously after the customer registers an elevated role. Possible values: PENDING_CONFIRMATION (validation in progress), VALID (role validated), INVALID (validation failed).
github (dict) --
GitHub repository integration configuration.
repoName (string) --
Associated Github repo name
repoId (string) --
Associated Github repo ID
owner (string) --
The GitHub repository owner name.
ownerType (string) --
Type of GitHub repository owner.
instanceIdentifier (string) --
GitHub instance identifier (e.g., github.com or github.enterprise.com)
runtimeRoleArn (string) --
Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
slack (dict) --
Slack workspace integration configuration.
workspaceId (string) --
Associated Slack workspace ID
workspaceName (string) --
Associated Slack workspace name
transmissionTarget (dict) --
Transmission targets for agent notifications
opsOncallTarget (dict) --
Destination for On-call Agent (Ops1)
channelName (string) --
Slack channel name
channelId (string) --
Slack channel ID
opsSRETarget (dict) --
Destination for SRE Agent (Ops1.5)
channelName (string) --
Slack channel name
channelId (string) --
Slack channel ID
dynatrace (dict) --
Dynatrace monitoring integration configuration.
envId (string) --
Dynatrace environment id
resources (list) --
List of Dynatrace resources to monitor
(string) --
servicenow (dict) --
ServiceNow instance integration configuration.
instanceId (string) --
ServiceNow instance ID
authScopes (list) --
Scoped down authentication scopes for fine grained control
(string) --
mcpservernewrelic (dict) --
NewRelic instance integration configuration.
accountId (string) --
New Relic Account ID
endpoint (string) --
MCP server endpoint URL (e.g., https://mcp.newrelic.com/mcp/)
mcpserverdatadog (dict) --
Datadog MCP server integration configuration.
enabledElevatedTools (list) --
The subset of elevated-access tools enabled for this integration.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
mcpserver (dict) --
MCP (Model Context Protocol) server integration configuration.
tools (list) --
List of MCP tools can be used with the association.
(string) --
toolDetails (list) --
List of MCP tools with their access categorization. When provided, the tool names must match those in the tools member.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
gitlab (dict) --
GitLab project integration configuration.
projectId (string) --
GitLab numeric project ID.
projectPath (string) --
Full GitLab project path (e.g., namespace/project-name).
instanceIdentifier (string) --
GitLab instance identifier (e.g., gitlab.com or e2e.gamma.dev.us-east-1.gitlab.falco.ai.aws.dev)
runtimeRoleArn (string) --
Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
mcpserversplunk (dict) --
Splunk MCP server integration configuration.
eventChannel (dict) --
Event Channel instance integration configuration.
azure (dict) --
Azure subscription integration configuration.
subscriptionId (string) --
Azure subscription ID corresponding to provided resources.
azuredevops (dict) --
Azure DevOps project integration configuration.
organizationName (string) --
Azure DevOps organization name.
projectId (string) --
Azure DevOps project ID.
projectName (string) --
Azure DevOps project name.
mcpservergrafana (dict) --
Grafana MCP server integration configuration.
endpoint (string) --
Grafana instance URL (e.g., https://your-instance.grafana.net)
organizationId (string) --
The Grafana organization ID that can be used.
tools (list) --
List of MCP tools that can be used.
(string) --
enabledElevatedTools (list) --
The subset of elevated-access tools enabled for this integration.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
pagerduty (dict) --
PagerDuty integration configuration
services (list) --
List of Pagerduty service available for the association.
(string) --
customerEmail (string) --
Email to be used in Pagerduty API header
mcpserversigv4 (dict) --
SigV4-authenticated MCP server integration configuration.
tools (list) --
List of MCP tools available for the association.
(string) --
toolDetails (list) --
List of MCP tools with their access categorization. When provided, the tool names must match those in the tools member.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
remoteagent (dict) --
Remote A2A agent integration configuration (token-based auth).
remoteagentsigv4 (dict) --
Remote A2A agent integration configuration (SigV4 auth).
capabilities (dict) --
Enabled capabilities for this association.
(string) --
AWS DevOps Agent capability types representing the set of automated capabilities that can be enabled per association.
(dict) --
Capability configuration for the AWS DevOps Agent.
enabled (boolean) --
Whether the capability is enabled.
webhook (dict) --
Generic webhook configuration
webhookUrl (string) --
The webhook URL endpoint
webhookId (string) --
The unique webhook identifier
webhookType (string) --
The webhook authentication type
webhookSecret (string) --
The webhook secret for authentication
apiKey (string) --
API Key for API Key webhook authentication
{'preferences': {'elevatedActionsEnabled': 'boolean'}}
Response {'agentSpace': {'preferences': {'elevatedActionsEnabled': 'boolean'}}}
Creates a new AgentSpace with the specified name and description. Duplicate space names are allowed.
See also: AWS API Documentation
Request Syntax
client.create_agent_space(
name='string',
description='string',
locale='string',
kmsKeyArn='string',
clientToken='string',
tags={
'string': 'string'
},
preferences={
'string': True|False
}
)
string
[REQUIRED]
The name of the AgentSpace.
string
The description of the AgentSpace.
string
The locale for the AgentSpace, which determines the language used in agent responses.
string
The ARN of the AWS Key Management Service (AWS KMS) customer managed key that's used to encrypt resources.
string
Client-provided token to ensure request idempotency. When the same token is provided in subsequent calls, the same response is returned within a 8-hour window.
This field is autopopulated if not provided.
dict
Tags to add to the AgentSpace at creation time.
(string) --
Tag key string.
(string) --
Tag value string.
dict
The preferences to configure on the agent space. Preferences not provided take their default values.
(string) --
The key of a preference that can be configured on an agent space. The elevatedActionsEnabled key controls whether elevated directed actions are permitted in the agent space. Elevated directed actions are mutating operations that also require per-action operator approval, and default to false when not set.
(boolean) --
dict
Response Syntax
{
'agentSpace': {
'name': 'string',
'description': 'string',
'locale': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'kmsKeyArn': 'string',
'agentSpaceId': 'string',
'preferences': {
'string': True|False
}
},
'tags': {
'string': 'string'
}
}
Response Structure
(dict) --
Output containing the newly created AgentSpace.
agentSpace (dict) --
Represents a complete AgentSpace with all its properties, timestamps, encryption settings, and unique identifier.
name (string) --
The name of the AgentSpace.
description (string) --
The description of the AgentSpace.
locale (string) --
The locale for the AgentSpace, which determines the language used in agent responses.
createdAt (datetime) --
The timestamp when the resource was created.
updatedAt (datetime) --
The timestamp when the resource was last updated.
kmsKeyArn (string) --
The ARN of the AWS Key Management Service (AWS KMS) customer managed key that's used to encrypt resources.
agentSpaceId (string) --
The unique identifier of the AgentSpace
preferences (dict) --
The preferences configured on the agent space. Preferences that are not set take their default values.
(string) --
The key of a preference that can be configured on an agent space. The elevatedActionsEnabled key controls whether elevated directed actions are permitted in the agent space. Elevated directed actions are mutating operations that also require per-action operator approval, and default to false when not set.
(boolean) --
tags (dict) --
Tags associated with the created AgentSpace.
(string) --
Tag key string.
(string) --
Tag value string.
{'task': {'status': {'WAITING'}}}
Creates a new backlog task in the specified agent space
See also: AWS API Documentation
Request Syntax
client.create_backlog_task(
agentSpaceId='string',
reference={
'system': 'string',
'title': 'string',
'referenceId': 'string',
'referenceUrl': 'string',
'associationId': 'string'
},
taskType='INVESTIGATION'|'EVALUATION'|'RELEASE_READINESS_REVIEW'|'RELEASE_TESTING',
title='string',
description='string',
priority='CRITICAL'|'HIGH'|'MEDIUM'|'LOW'|'MINIMAL',
clientToken='string'
)
string
[REQUIRED]
The unique identifier for the agent space where the task will be created
dict
Optional reference information for the task
system (string) -- [REQUIRED]
The name of the external system
title (string) --
Optional title for the reference
referenceId (string) -- [REQUIRED]
The unique identifier in the external system
referenceUrl (string) -- [REQUIRED]
URL to access the reference in the external system
associationId (string) -- [REQUIRED]
Association identifier of the external system
string
[REQUIRED]
The type of task being created
string
[REQUIRED]
The title of the backlog task
string
Optional detailed description of the task
string
[REQUIRED]
The priority level of the task
string
Client-provided token for idempotent operations
This field is autopopulated if not provided.
dict
Response Syntax
{
'task': {
'agentSpaceId': 'string',
'taskId': 'string',
'executionId': 'string',
'title': 'string',
'description': 'string',
'reference': {
'system': 'string',
'title': 'string',
'referenceId': 'string',
'referenceUrl': 'string',
'associationId': 'string'
},
'taskType': 'INVESTIGATION'|'EVALUATION'|'RELEASE_READINESS_REVIEW'|'RELEASE_TESTING',
'priority': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW'|'MINIMAL',
'status': 'PENDING_TRIAGE'|'LINKED'|'PENDING_START'|'IN_PROGRESS'|'PENDING_CUSTOMER_APPROVAL'|'COMPLETED'|'FAILED'|'TIMED_OUT'|'CANCELED'|'SKIPPED'|'WAITING',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'version': 123,
'supportMetadata': {...}|[...]|123|123.4|'string'|True|None,
'metadata': {...}|[...]|123|123.4|'string'|True|None,
'primaryTaskId': 'string',
'statusReason': 'string',
'hasLinkedTasks': True|False
}
}
Response Structure
(dict) --
Response structure containing the created backlog task
task (dict) --
The newly created task object
agentSpaceId (string) --
The unique identifier for the agent space containing this task
taskId (string) --
The unique identifier for this task
executionId (string) --
The execution ID associated with this task, if any
title (string) --
The title of the task
description (string) --
Optional detailed description of the task
reference (dict) --
Optional reference information linking this task to external systems
system (string) --
The name of the external system
title (string) --
Optional title for the reference
referenceId (string) --
The unique identifier in the external system
referenceUrl (string) --
URL to access the reference in the external system
associationId (string) --
Association identifier of the external system
taskType (string) --
The type of this task
priority (string) --
The priority level of this task
status (string) --
The current status of this task
createdAt (datetime) --
Timestamp when this task was created
updatedAt (datetime) --
Timestamp when this task was last updated
version (integer) --
Version number for optimistic locking
supportMetadata (:ref:`document<document>`) --
Optional support metadata for the task
metadata (:ref:`document<document>`) --
Optional metadata for the task
primaryTaskId (string) --
The task ID of the primary investigation this task is linked to
statusReason (string) --
Explanation for why the task status was changed (e.g., linked reason)
hasLinkedTasks (boolean) --
Indicates if this task has other tasks linked to it
{'agentSpace': {'preferences': {'elevatedActionsEnabled': 'boolean'}}}
Retrieves detailed information about a specific AgentSpace.
See also: AWS API Documentation
Request Syntax
client.get_agent_space(
agentSpaceId='string'
)
string
[REQUIRED]
The unique identifier of the AgentSpace
dict
Response Syntax
{
'agentSpace': {
'name': 'string',
'description': 'string',
'locale': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'kmsKeyArn': 'string',
'agentSpaceId': 'string',
'preferences': {
'string': True|False
}
},
'tags': {
'string': 'string'
}
}
Response Structure
(dict) --
Output containing the requested AgentSpace details.
agentSpace (dict) --
Represents a complete AgentSpace with all its properties, timestamps, encryption settings, and unique identifier.
name (string) --
The name of the AgentSpace.
description (string) --
The description of the AgentSpace.
locale (string) --
The locale for the AgentSpace, which determines the language used in agent responses.
createdAt (datetime) --
The timestamp when the resource was created.
updatedAt (datetime) --
The timestamp when the resource was last updated.
kmsKeyArn (string) --
The ARN of the AWS Key Management Service (AWS KMS) customer managed key that's used to encrypt resources.
agentSpaceId (string) --
The unique identifier of the AgentSpace
preferences (dict) --
The preferences configured on the agent space. Preferences that are not set take their default values.
(string) --
The key of a preference that can be configured on an agent space. The elevatedActionsEnabled key controls whether elevated directed actions are permitted in the agent space. Elevated directed actions are mutating operations that also require per-action operator approval, and default to false when not set.
(boolean) --
tags (dict) --
Tags associated with the AgentSpace.
(string) --
Tag key string.
(string) --
Tag value string.
{'association': {'configuration': {'aws': {'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid '
'| '
'invalid '
'| '
'pending-confirmation'},
'mcpserver': {'toolDetails': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpserverdatadog': {'enabledElevatedTools': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpservergrafana': {'enabledElevatedTools': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpserversigv4': {'toolDetails': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'sourceAws': {'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid '
'| '
'invalid '
'| '
'pending-confirmation'}}}}
Retrieves given associations configured for a specific AgentSpace.
See also: AWS API Documentation
Request Syntax
client.get_association(
agentSpaceId='string',
associationId='string'
)
string
[REQUIRED]
The unique identifier of the AgentSpace
string
[REQUIRED]
The unique identifier of the given association.
dict
Response Syntax
{
'association': {
'agentSpaceId': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'status': 'valid'|'invalid'|'pending-confirmation',
'associationId': 'string',
'serviceId': 'string',
'configuration': {
'sourceAws': {
'accountId': 'string',
'accountType': 'source',
'assumableRoleArn': 'string',
'externalId': 'string',
'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid'|'invalid'|'pending-confirmation'
},
'aws': {
'assumableRoleArn': 'string',
'accountId': 'string',
'accountType': 'monitor',
'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid'|'invalid'|'pending-confirmation'
},
'github': {
'repoName': 'string',
'repoId': 'string',
'owner': 'string',
'ownerType': 'organization'|'user',
'instanceIdentifier': 'string',
'runtimeRoleArn': 'string'
},
'slack': {
'workspaceId': 'string',
'workspaceName': 'string',
'transmissionTarget': {
'opsOncallTarget': {
'channelName': 'string',
'channelId': 'string'
},
'opsSRETarget': {
'channelName': 'string',
'channelId': 'string'
}
}
},
'dynatrace': {
'envId': 'string',
'resources': [
'string',
]
},
'servicenow': {
'instanceId': 'string',
'authScopes': [
'string',
]
},
'mcpservernewrelic': {
'accountId': 'string',
'endpoint': 'string'
},
'mcpserverdatadog': {
'enabledElevatedTools': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'mcpserver': {
'tools': [
'string',
],
'toolDetails': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'gitlab': {
'projectId': 'string',
'projectPath': 'string',
'instanceIdentifier': 'string',
'runtimeRoleArn': 'string'
},
'mcpserversplunk': {},
'eventChannel': {},
'azure': {
'subscriptionId': 'string'
},
'azuredevops': {
'organizationName': 'string',
'projectId': 'string',
'projectName': 'string'
},
'mcpservergrafana': {
'endpoint': 'string',
'organizationId': 'string',
'tools': [
'string',
],
'enabledElevatedTools': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'pagerduty': {
'services': [
'string',
],
'customerEmail': 'string'
},
'mcpserversigv4': {
'tools': [
'string',
],
'toolDetails': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'remoteagent': {},
'remoteagentsigv4': {}
},
'capabilities': {
'string': {
'enabled': True|False
}
}
}
}
Response Structure
(dict) --
Output containing the requested association details.
association (dict) --
Represents a service association within an AgentSpace, defining how the agent interacts with external services.
agentSpaceId (string) --
The unique identifier of the AgentSpace
createdAt (datetime) --
The timestamp when the resource was created.
updatedAt (datetime) --
The timestamp when the resource was last updated.
status (string) --
Validation status
associationId (string) --
The unique identifier of the given association.
serviceId (string) --
The identifier for associated service
configuration (dict) --
The configuration that directs how AgentSpace interacts with the given service.
sourceAws (dict) --
AWS source account configuration for monitoring resources.
accountId (string) --
AWS Account Id corresponding to provided resources.
accountType (string) --
Account Type 'source' for AIDevOps monitoring.
assumableRoleArn (string) --
Role ARN to be assumed by AIDevOps to operate on behalf of customer. To set this role ARN on AssociateService or UpdateAssociation, the caller must have at least the iam:PassRole permission on arn:aws:iam::<account-id>:role/* in the caller's own account, with the condition iam:PassedToService set to aidevops.amazonaws.com. A broader iam:PassRole grant also satisfies this requirement.
externalId (string) --
External ID for additional security when assuming the role. Used to prevent the confused deputy problem.
agentElevatedRoleArn (string) --
Optional IAM role ARN to be assumed by AIDevOps for elevated directed actions on behalf of the customer. Used for mutating operations gated by elevatedActionsEnabled on the AgentSpace. When not provided, only non-elevated directed actions are available for this AWS account. Setting this role is subject to the same minimum iam:PassRole requirement described on assumableRoleArn.
agentElevatedRoleArnStatus (string) --
Validation status of the agentElevatedRoleArn. Updated asynchronously after the customer registers an elevated role. Possible values: PENDING_CONFIRMATION (validation in progress), VALID (role validated), INVALID (validation failed).
aws (dict) --
AWS monitor account configuration.
assumableRoleArn (string) --
Role ARN to be assumed by AIDevOps to operate on behalf of customer.
accountId (string) --
AWS Account Id corresponding to provided resources.
accountType (string) --
Account Type 'monitor' for AIDevOps monitoring.
agentElevatedRoleArn (string) --
Optional IAM role ARN to be assumed by AIDevOps for elevated directed actions on behalf of the customer. Used for mutating operations gated by elevatedActionsEnabled on the AgentSpace. When not provided, only non-elevated directed actions are available for this AWS account.
agentElevatedRoleArnStatus (string) --
Validation status of the agentElevatedRoleArn. Updated asynchronously after the customer registers an elevated role. Possible values: PENDING_CONFIRMATION (validation in progress), VALID (role validated), INVALID (validation failed).
github (dict) --
GitHub repository integration configuration.
repoName (string) --
Associated Github repo name
repoId (string) --
Associated Github repo ID
owner (string) --
The GitHub repository owner name.
ownerType (string) --
Type of GitHub repository owner.
instanceIdentifier (string) --
GitHub instance identifier (e.g., github.com or github.enterprise.com)
runtimeRoleArn (string) --
Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
slack (dict) --
Slack workspace integration configuration.
workspaceId (string) --
Associated Slack workspace ID
workspaceName (string) --
Associated Slack workspace name
transmissionTarget (dict) --
Transmission targets for agent notifications
opsOncallTarget (dict) --
Destination for On-call Agent (Ops1)
channelName (string) --
Slack channel name
channelId (string) --
Slack channel ID
opsSRETarget (dict) --
Destination for SRE Agent (Ops1.5)
channelName (string) --
Slack channel name
channelId (string) --
Slack channel ID
dynatrace (dict) --
Dynatrace monitoring integration configuration.
envId (string) --
Dynatrace environment id
resources (list) --
List of Dynatrace resources to monitor
(string) --
servicenow (dict) --
ServiceNow instance integration configuration.
instanceId (string) --
ServiceNow instance ID
authScopes (list) --
Scoped down authentication scopes for fine grained control
(string) --
mcpservernewrelic (dict) --
NewRelic instance integration configuration.
accountId (string) --
New Relic Account ID
endpoint (string) --
MCP server endpoint URL (e.g., https://mcp.newrelic.com/mcp/)
mcpserverdatadog (dict) --
Datadog MCP server integration configuration.
enabledElevatedTools (list) --
The subset of elevated-access tools enabled for this integration.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
mcpserver (dict) --
MCP (Model Context Protocol) server integration configuration.
tools (list) --
List of MCP tools can be used with the association.
(string) --
toolDetails (list) --
List of MCP tools with their access categorization. When provided, the tool names must match those in the tools member.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
gitlab (dict) --
GitLab project integration configuration.
projectId (string) --
GitLab numeric project ID.
projectPath (string) --
Full GitLab project path (e.g., namespace/project-name).
instanceIdentifier (string) --
GitLab instance identifier (e.g., gitlab.com or e2e.gamma.dev.us-east-1.gitlab.falco.ai.aws.dev)
runtimeRoleArn (string) --
Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
mcpserversplunk (dict) --
Splunk MCP server integration configuration.
eventChannel (dict) --
Event Channel instance integration configuration.
azure (dict) --
Azure subscription integration configuration.
subscriptionId (string) --
Azure subscription ID corresponding to provided resources.
azuredevops (dict) --
Azure DevOps project integration configuration.
organizationName (string) --
Azure DevOps organization name.
projectId (string) --
Azure DevOps project ID.
projectName (string) --
Azure DevOps project name.
mcpservergrafana (dict) --
Grafana MCP server integration configuration.
endpoint (string) --
Grafana instance URL (e.g., https://your-instance.grafana.net)
organizationId (string) --
The Grafana organization ID that can be used.
tools (list) --
List of MCP tools that can be used.
(string) --
enabledElevatedTools (list) --
The subset of elevated-access tools enabled for this integration.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
pagerduty (dict) --
PagerDuty integration configuration
services (list) --
List of Pagerduty service available for the association.
(string) --
customerEmail (string) --
Email to be used in Pagerduty API header
mcpserversigv4 (dict) --
SigV4-authenticated MCP server integration configuration.
tools (list) --
List of MCP tools available for the association.
(string) --
toolDetails (list) --
List of MCP tools with their access categorization. When provided, the tool names must match those in the tools member.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
remoteagent (dict) --
Remote A2A agent integration configuration (token-based auth).
remoteagentsigv4 (dict) --
Remote A2A agent integration configuration (SigV4 auth).
capabilities (dict) --
Enabled capabilities for this association.
(string) --
AWS DevOps Agent capability types representing the set of automated capabilities that can be enabled per association.
(dict) --
Capability configuration for the AWS DevOps Agent.
enabled (boolean) --
Whether the capability is enabled.
{'task': {'status': {'WAITING'}}}
Gets a backlog task for the specified agent space and task id
See also: AWS API Documentation
Request Syntax
client.get_backlog_task(
agentSpaceId='string',
taskId='string'
)
string
[REQUIRED]
The unique identifier for the agent space containing the task
string
[REQUIRED]
The unique identifier of the task to retrieve
dict
Response Syntax
{
'task': {
'agentSpaceId': 'string',
'taskId': 'string',
'executionId': 'string',
'title': 'string',
'description': 'string',
'reference': {
'system': 'string',
'title': 'string',
'referenceId': 'string',
'referenceUrl': 'string',
'associationId': 'string'
},
'taskType': 'INVESTIGATION'|'EVALUATION'|'RELEASE_READINESS_REVIEW'|'RELEASE_TESTING',
'priority': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW'|'MINIMAL',
'status': 'PENDING_TRIAGE'|'LINKED'|'PENDING_START'|'IN_PROGRESS'|'PENDING_CUSTOMER_APPROVAL'|'COMPLETED'|'FAILED'|'TIMED_OUT'|'CANCELED'|'SKIPPED'|'WAITING',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'version': 123,
'supportMetadata': {...}|[...]|123|123.4|'string'|True|None,
'metadata': {...}|[...]|123|123.4|'string'|True|None,
'primaryTaskId': 'string',
'statusReason': 'string',
'hasLinkedTasks': True|False
}
}
Response Structure
(dict) --
Response structure containing the requested backlog task
task (dict) --
The requested task object
agentSpaceId (string) --
The unique identifier for the agent space containing this task
taskId (string) --
The unique identifier for this task
executionId (string) --
The execution ID associated with this task, if any
title (string) --
The title of the task
description (string) --
Optional detailed description of the task
reference (dict) --
Optional reference information linking this task to external systems
system (string) --
The name of the external system
title (string) --
Optional title for the reference
referenceId (string) --
The unique identifier in the external system
referenceUrl (string) --
URL to access the reference in the external system
associationId (string) --
Association identifier of the external system
taskType (string) --
The type of this task
priority (string) --
The priority level of this task
status (string) --
The current status of this task
createdAt (datetime) --
Timestamp when this task was created
updatedAt (datetime) --
Timestamp when this task was last updated
version (integer) --
Version number for optimistic locking
supportMetadata (:ref:`document<document>`) --
Optional support metadata for the task
metadata (:ref:`document<document>`) --
Optional metadata for the task
primaryTaskId (string) --
The task ID of the primary investigation this task is linked to
statusReason (string) --
Explanation for why the task status was changed (e.g., linked reason)
hasLinkedTasks (boolean) --
Indicates if this task has other tasks linked to it
{'service': {'additionalServiceDetails': {'mcpservernewrelic': {'region': {'JP'}}},
'createdAt': 'timestamp',
'updatedAt': 'timestamp'}}
Retrieves given service by it's unique identifier
See also: AWS API Documentation
Request Syntax
client.get_service(
serviceId='string'
)
string
[REQUIRED]
The unique identifier of the given service.
dict
Response Syntax
{
'service': {
'serviceId': 'string',
'serviceType': 'github'|'slack'|'azure'|'azuredevops'|'dynatrace'|'servicenow'|'pagerduty'|'gitlab'|'eventChannel'|'mcpservernewrelic'|'mcpservergrafana'|'mcpserverdatadog'|'mcpserver'|'mcpserversplunk'|'azureidentity'|'mcpserversigv4'|'remoteagent'|'remoteagentsigv4',
'name': 'string',
'accessibleResources': [
{...}|[...]|123|123.4|'string'|True|None,
],
'additionalServiceDetails': {
'github': {
'owner': 'string',
'ownerType': 'organization'|'user',
'targetUrl': 'string'
},
'slack': {
'teamId': 'string',
'teamName': 'string'
},
'mcpserverdatadog': {
'name': 'string',
'endpoint': 'string',
'authorizationMethod': 'oauth-client-credentials'|'oauth-3lo'|'api-key'|'bearer-token',
'description': 'string',
'apiKeyHeader': 'string'
},
'mcpserver': {
'name': 'string',
'endpoint': 'string',
'authorizationMethod': 'oauth-client-credentials'|'oauth-3lo'|'api-key'|'bearer-token',
'description': 'string',
'apiKeyHeader': 'string'
},
'servicenow': {
'instanceUrl': 'string'
},
'gitlab': {
'targetUrl': 'string',
'tokenType': 'personal'|'group',
'groupId': 'string'
},
'mcpserversplunk': {
'name': 'string',
'endpoint': 'string',
'authorizationMethod': 'oauth-client-credentials'|'oauth-3lo'|'api-key'|'bearer-token',
'description': 'string',
'apiKeyHeader': 'string'
},
'mcpservernewrelic': {
'accountId': 'string',
'region': 'US'|'EU'|'JP',
'description': 'string'
},
'azuredevops': {
'organizationName': 'string'
},
'azureidentity': {
'tenantId': 'string',
'clientId': 'string',
'webIdentityRoleArn': 'string',
'webIdentityTokenAudiences': [
'string',
]
},
'mcpservergrafana': {
'endpoint': 'string',
'authorizationMethod': 'oauth-client-credentials'|'oauth-3lo'|'api-key'|'bearer-token'
},
'pagerduty': {
'scopes': [
'string',
]
},
'mcpserversigv4': {
'name': 'string',
'endpoint': 'string',
'description': 'string',
'region': 'string',
'service': 'string',
'roleArn': 'string',
'mcpRoleArn': 'string',
'customHeaders': {
'string': 'string'
}
},
'remoteagent': {
'name': 'string',
'endpoint': 'string',
'description': 'string',
'authorizationMethod': 'oauth-client-credentials'|'api-key'|'bearer-token',
'apiKeyHeader': 'string'
},
'remoteagentsigv4': {
'name': 'string',
'endpoint': 'string',
'description': 'string',
'region': 'string',
'service': 'string',
'roleArn': 'string'
}
},
'kmsKeyArn': 'string',
'privateConnectionName': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
},
'tags': {
'string': 'string'
}
}
Response Structure
(dict) --
Output containing the requested service details.
service (dict) --
Represents a registered service with its configuration and accessible resources.
serviceId (string) --
The unique identifier of a service.
serviceType (string) --
The service type e.g github or dynatrace
name (string) --
The display name of the registered service.
accessibleResources (list) --
List of accessible resources for this service.
(:ref:`document<document>`) --
additionalServiceDetails (dict) --
Additional details specific to the service type.
github (dict) --
GitHub-specific service details.
owner (string) --
The GitHub repository owner name.
ownerType (string) --
The GitHub repository owner type.
targetUrl (string) --
The GitHub Enterprise Server instance URL (absent for github.com).
slack (dict) --
Slack-specific service details.
teamId (string) --
The Slack team ID.
teamName (string) --
The Slack team name.
mcpserverdatadog (dict) --
Datadog MCP server-specific service details.
name (string) --
The MCP server name.
endpoint (string) --
The MCP server endpoint URL.
authorizationMethod (string) --
The MCP server uses this authorization method.
description (string) --
Optional description for the MCP server.
apiKeyHeader (string) --
If the MCP server uses API key authentication, these details are provided.
mcpserver (dict) --
MCP server-specific service details.
name (string) --
The MCP server name.
endpoint (string) --
The MCP server endpoint URL.
authorizationMethod (string) --
The MCP server uses this authorization method.
description (string) --
Optional description for the MCP server.
apiKeyHeader (string) --
If the MCP server uses API key authentication, these details are provided.
servicenow (dict) --
ServiceNow-specific service details.
instanceUrl (string) --
The ServiceNow instance url
gitlab (dict) --
GitLab-specific service details.
targetUrl (string) --
The GitLab instance URL.
tokenType (string) --
Type of GitLab access token
groupId (string) --
Optional GitLab group ID for group-level access tokens
mcpserversplunk (dict) --
Splunk MCP server-specific service details.
name (string) --
The MCP server name.
endpoint (string) --
The MCP server endpoint URL.
authorizationMethod (string) --
The MCP server uses this authorization method.
description (string) --
Optional description for the MCP server.
apiKeyHeader (string) --
If the MCP server uses API key authentication, these details are provided.
mcpservernewrelic (dict) --
New Relic MCP server-specific service details.
accountId (string) --
The NewRelic account ID.
region (string) --
The NewRelic region (determines API endpoint).
description (string) --
Optional user description.
azuredevops (dict) --
Azure DevOps specific service details.
organizationName (string) --
The Azure DevOps Organization name associated with the service.
azureidentity (dict) --
Azure identity details for services using Azure authentication.
tenantId (string) --
The Azure Active Directory tenant ID for the identity.
clientId (string) --
The client ID of the service principal or managed identity used for authentication.
webIdentityRoleArn (string) --
The role ARN to be assumed by DevOps Agent for requesting Web Identity Token.
webIdentityTokenAudiences (list) --
The audiences for the Web Identity Token.
(string) --
mcpservergrafana (dict) --
Grafana MCP server-specific service details.
endpoint (string) --
Grafana instance URL (e.g., https://your-instance.grafana.net)
authorizationMethod (string) --
The authz method used by the MCP server.
pagerduty (dict) --
Pagerduty service details.
scopes (list) --
The scopes that were assigned to the service
(string) --
mcpserversigv4 (dict) --
SigV4-authenticated MCP server-specific service details.
name (string) --
MCP server name.
endpoint (string) --
MCP server endpoint URL.
description (string) --
Optional description for the MCP server.
region (string) --
AWS region for SigV4 signing. Use '*' for SigV4a multi-region signing.
service (string) --
AWS service name for SigV4 signing.
roleArn (string) --
IAM role ARN to assume for SigV4 signing.
mcpRoleArn (string) --
AWS IAM role ARN.
customHeaders (dict) --
Custom headers for the SigV4 MCP server.
(string) --
HTTP header name. Allows alphanumeric characters, hyphens, and underscores.
(string) --
Value type for custom headers.
remoteagent (dict) --
Remote A2A agent-specific service details (token-based auth).
name (string) --
Name identifier for a remote A2A agent.
endpoint (string) --
HTTPS endpoint URL for a remote A2A agent.
description (string) --
Description field
authorizationMethod (string) --
The authorization method used by the remote agent.
apiKeyHeader (string) --
If the remote agent uses API key authentication, the header name.
remoteagentsigv4 (dict) --
Remote A2A agent-specific service details (SigV4 auth).
name (string) --
Name identifier for a remote A2A agent.
endpoint (string) --
HTTPS endpoint URL for a remote A2A agent.
description (string) --
Description field
region (string) --
AWS region identifier or wildcard (*) for SigV4a multi-region signing.
service (string) --
The AWS service name for SigV4 signing.
roleArn (string) --
AWS IAM role ARN.
kmsKeyArn (string) --
The ARN of the AWS Key Management Service (AWS KMS) customer managed key that's used to encrypt resources.
privateConnectionName (string) --
The name of the private connection used for VPC connectivity.
createdAt (datetime) --
The timestamp when the service was registered.
updatedAt (datetime) --
The timestamp when the service was last updated.
tags (dict) --
Tags associated with the Service.
(string) --
Tag key string.
(string) --
Tag value string.
{'agentSpaces': {'preferences': {'elevatedActionsEnabled': 'boolean'}}}
Lists all AgentSpaces with optional pagination.
See also: AWS API Documentation
Request Syntax
client.list_agent_spaces(
maxResults=123,
nextToken='string'
)
integer
Maximum number of results to return in a single call.
string
Token for the next page of results.
dict
Response Syntax
{
'nextToken': 'string',
'agentSpaces': [
{
'name': 'string',
'description': 'string',
'locale': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'kmsKeyArn': 'string',
'agentSpaceId': 'string',
'preferences': {
'string': True|False
}
},
]
}
Response Structure
(dict) --
Output containing a list of AgentSpaces and pagination token.
nextToken (string) --
Token to retrieve the next page of results, if there are more results.
agentSpaces (list) --
The list of AgentSpaces.
(dict) --
Represents a complete AgentSpace with all its properties, timestamps, encryption settings, and unique identifier.
name (string) --
The name of the AgentSpace.
description (string) --
The description of the AgentSpace.
locale (string) --
The locale for the AgentSpace, which determines the language used in agent responses.
createdAt (datetime) --
The timestamp when the resource was created.
updatedAt (datetime) --
The timestamp when the resource was last updated.
kmsKeyArn (string) --
The ARN of the AWS Key Management Service (AWS KMS) customer managed key that's used to encrypt resources.
agentSpaceId (string) --
The unique identifier of the AgentSpace
preferences (dict) --
The preferences configured on the agent space. Preferences that are not set take their default values.
(string) --
The key of a preference that can be configured on an agent space. The elevatedActionsEnabled key controls whether elevated directed actions are permitted in the agent space. Elevated directed actions are mutating operations that also require per-action operator approval, and default to false when not set.
(boolean) --
{'associations': {'configuration': {'aws': {'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid '
'| '
'invalid '
'| '
'pending-confirmation'},
'mcpserver': {'toolDetails': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpserverdatadog': {'enabledElevatedTools': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpservergrafana': {'enabledElevatedTools': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpserversigv4': {'toolDetails': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'sourceAws': {'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid '
'| '
'invalid '
'| '
'pending-confirmation'}}}}
List all associations for given AgentSpace
See also: AWS API Documentation
Request Syntax
client.list_associations(
agentSpaceId='string',
maxResults=123,
nextToken='string',
filterServiceTypes='string'
)
string
[REQUIRED]
The unique identifier of the AgentSpace
integer
Maximum number of results to return in a single call.
string
Token for the next page of results.
string
A comma-separated list of service types to filter list associations output
dict
Response Syntax
{
'nextToken': 'string',
'associations': [
{
'agentSpaceId': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'status': 'valid'|'invalid'|'pending-confirmation',
'associationId': 'string',
'serviceId': 'string',
'configuration': {
'sourceAws': {
'accountId': 'string',
'accountType': 'source',
'assumableRoleArn': 'string',
'externalId': 'string',
'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid'|'invalid'|'pending-confirmation'
},
'aws': {
'assumableRoleArn': 'string',
'accountId': 'string',
'accountType': 'monitor',
'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid'|'invalid'|'pending-confirmation'
},
'github': {
'repoName': 'string',
'repoId': 'string',
'owner': 'string',
'ownerType': 'organization'|'user',
'instanceIdentifier': 'string',
'runtimeRoleArn': 'string'
},
'slack': {
'workspaceId': 'string',
'workspaceName': 'string',
'transmissionTarget': {
'opsOncallTarget': {
'channelName': 'string',
'channelId': 'string'
},
'opsSRETarget': {
'channelName': 'string',
'channelId': 'string'
}
}
},
'dynatrace': {
'envId': 'string',
'resources': [
'string',
]
},
'servicenow': {
'instanceId': 'string',
'authScopes': [
'string',
]
},
'mcpservernewrelic': {
'accountId': 'string',
'endpoint': 'string'
},
'mcpserverdatadog': {
'enabledElevatedTools': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'mcpserver': {
'tools': [
'string',
],
'toolDetails': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'gitlab': {
'projectId': 'string',
'projectPath': 'string',
'instanceIdentifier': 'string',
'runtimeRoleArn': 'string'
},
'mcpserversplunk': {},
'eventChannel': {},
'azure': {
'subscriptionId': 'string'
},
'azuredevops': {
'organizationName': 'string',
'projectId': 'string',
'projectName': 'string'
},
'mcpservergrafana': {
'endpoint': 'string',
'organizationId': 'string',
'tools': [
'string',
],
'enabledElevatedTools': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'pagerduty': {
'services': [
'string',
],
'customerEmail': 'string'
},
'mcpserversigv4': {
'tools': [
'string',
],
'toolDetails': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'remoteagent': {},
'remoteagentsigv4': {}
},
'capabilities': {
'string': {
'enabled': True|False
}
}
},
]
}
Response Structure
(dict) --
Output containing a list of service associations and pagination token.
nextToken (string) --
Token to retrieve the next page of results, if there are more results.
associations (list) --
The list of associations.
(dict) --
Represents a service association within an AgentSpace, defining how the agent interacts with external services.
agentSpaceId (string) --
The unique identifier of the AgentSpace
createdAt (datetime) --
The timestamp when the resource was created.
updatedAt (datetime) --
The timestamp when the resource was last updated.
status (string) --
Validation status
associationId (string) --
The unique identifier of the given association.
serviceId (string) --
The identifier for associated service
configuration (dict) --
The configuration that directs how AgentSpace interacts with the given service.
sourceAws (dict) --
AWS source account configuration for monitoring resources.
accountId (string) --
AWS Account Id corresponding to provided resources.
accountType (string) --
Account Type 'source' for AIDevOps monitoring.
assumableRoleArn (string) --
Role ARN to be assumed by AIDevOps to operate on behalf of customer. To set this role ARN on AssociateService or UpdateAssociation, the caller must have at least the iam:PassRole permission on arn:aws:iam::<account-id>:role/* in the caller's own account, with the condition iam:PassedToService set to aidevops.amazonaws.com. A broader iam:PassRole grant also satisfies this requirement.
externalId (string) --
External ID for additional security when assuming the role. Used to prevent the confused deputy problem.
agentElevatedRoleArn (string) --
Optional IAM role ARN to be assumed by AIDevOps for elevated directed actions on behalf of the customer. Used for mutating operations gated by elevatedActionsEnabled on the AgentSpace. When not provided, only non-elevated directed actions are available for this AWS account. Setting this role is subject to the same minimum iam:PassRole requirement described on assumableRoleArn.
agentElevatedRoleArnStatus (string) --
Validation status of the agentElevatedRoleArn. Updated asynchronously after the customer registers an elevated role. Possible values: PENDING_CONFIRMATION (validation in progress), VALID (role validated), INVALID (validation failed).
aws (dict) --
AWS monitor account configuration.
assumableRoleArn (string) --
Role ARN to be assumed by AIDevOps to operate on behalf of customer.
accountId (string) --
AWS Account Id corresponding to provided resources.
accountType (string) --
Account Type 'monitor' for AIDevOps monitoring.
agentElevatedRoleArn (string) --
Optional IAM role ARN to be assumed by AIDevOps for elevated directed actions on behalf of the customer. Used for mutating operations gated by elevatedActionsEnabled on the AgentSpace. When not provided, only non-elevated directed actions are available for this AWS account.
agentElevatedRoleArnStatus (string) --
Validation status of the agentElevatedRoleArn. Updated asynchronously after the customer registers an elevated role. Possible values: PENDING_CONFIRMATION (validation in progress), VALID (role validated), INVALID (validation failed).
github (dict) --
GitHub repository integration configuration.
repoName (string) --
Associated Github repo name
repoId (string) --
Associated Github repo ID
owner (string) --
The GitHub repository owner name.
ownerType (string) --
Type of GitHub repository owner.
instanceIdentifier (string) --
GitHub instance identifier (e.g., github.com or github.enterprise.com)
runtimeRoleArn (string) --
Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
slack (dict) --
Slack workspace integration configuration.
workspaceId (string) --
Associated Slack workspace ID
workspaceName (string) --
Associated Slack workspace name
transmissionTarget (dict) --
Transmission targets for agent notifications
opsOncallTarget (dict) --
Destination for On-call Agent (Ops1)
channelName (string) --
Slack channel name
channelId (string) --
Slack channel ID
opsSRETarget (dict) --
Destination for SRE Agent (Ops1.5)
channelName (string) --
Slack channel name
channelId (string) --
Slack channel ID
dynatrace (dict) --
Dynatrace monitoring integration configuration.
envId (string) --
Dynatrace environment id
resources (list) --
List of Dynatrace resources to monitor
(string) --
servicenow (dict) --
ServiceNow instance integration configuration.
instanceId (string) --
ServiceNow instance ID
authScopes (list) --
Scoped down authentication scopes for fine grained control
(string) --
mcpservernewrelic (dict) --
NewRelic instance integration configuration.
accountId (string) --
New Relic Account ID
endpoint (string) --
MCP server endpoint URL (e.g., https://mcp.newrelic.com/mcp/)
mcpserverdatadog (dict) --
Datadog MCP server integration configuration.
enabledElevatedTools (list) --
The subset of elevated-access tools enabled for this integration.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
mcpserver (dict) --
MCP (Model Context Protocol) server integration configuration.
tools (list) --
List of MCP tools can be used with the association.
(string) --
toolDetails (list) --
List of MCP tools with their access categorization. When provided, the tool names must match those in the tools member.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
gitlab (dict) --
GitLab project integration configuration.
projectId (string) --
GitLab numeric project ID.
projectPath (string) --
Full GitLab project path (e.g., namespace/project-name).
instanceIdentifier (string) --
GitLab instance identifier (e.g., gitlab.com or e2e.gamma.dev.us-east-1.gitlab.falco.ai.aws.dev)
runtimeRoleArn (string) --
Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
mcpserversplunk (dict) --
Splunk MCP server integration configuration.
eventChannel (dict) --
Event Channel instance integration configuration.
azure (dict) --
Azure subscription integration configuration.
subscriptionId (string) --
Azure subscription ID corresponding to provided resources.
azuredevops (dict) --
Azure DevOps project integration configuration.
organizationName (string) --
Azure DevOps organization name.
projectId (string) --
Azure DevOps project ID.
projectName (string) --
Azure DevOps project name.
mcpservergrafana (dict) --
Grafana MCP server integration configuration.
endpoint (string) --
Grafana instance URL (e.g., https://your-instance.grafana.net)
organizationId (string) --
The Grafana organization ID that can be used.
tools (list) --
List of MCP tools that can be used.
(string) --
enabledElevatedTools (list) --
The subset of elevated-access tools enabled for this integration.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
pagerduty (dict) --
PagerDuty integration configuration
services (list) --
List of Pagerduty service available for the association.
(string) --
customerEmail (string) --
Email to be used in Pagerduty API header
mcpserversigv4 (dict) --
SigV4-authenticated MCP server integration configuration.
tools (list) --
List of MCP tools available for the association.
(string) --
toolDetails (list) --
List of MCP tools with their access categorization. When provided, the tool names must match those in the tools member.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
remoteagent (dict) --
Remote A2A agent integration configuration (token-based auth).
remoteagentsigv4 (dict) --
Remote A2A agent integration configuration (SigV4 auth).
capabilities (dict) --
Enabled capabilities for this association.
(string) --
AWS DevOps Agent capability types representing the set of automated capabilities that can be enabled per association.
(dict) --
Capability configuration for the AWS DevOps Agent.
enabled (boolean) --
Whether the capability is enabled.
{'filter': {'status': {'WAITING'}}}
Response {'tasks': {'status': {'WAITING'}}}
Lists backlog tasks in the specified agent space with optional filtering and sorting
See also: AWS API Documentation
Request Syntax
client.list_backlog_tasks(
agentSpaceId='string',
filter={
'createdAfter': datetime(2015, 1, 1),
'createdBefore': datetime(2015, 1, 1),
'priority': [
'CRITICAL'|'HIGH'|'MEDIUM'|'LOW'|'MINIMAL',
],
'status': [
'PENDING_TRIAGE'|'LINKED'|'PENDING_START'|'IN_PROGRESS'|'PENDING_CUSTOMER_APPROVAL'|'COMPLETED'|'FAILED'|'TIMED_OUT'|'CANCELED'|'SKIPPED'|'WAITING',
],
'taskType': [
'INVESTIGATION'|'EVALUATION'|'RELEASE_READINESS_REVIEW'|'RELEASE_TESTING',
],
'primaryTaskId': 'string'
},
limit=123,
nextToken='string',
sortField='CREATED_AT'|'PRIORITY',
order='ASC'|'DESC'
)
string
[REQUIRED]
The unique identifier for the agent space containing the tasks
dict
Filter criteria to apply when listing tasks Filtering restrictions: - Each filter field list is limited to a single value - Filtering by Priority and Status at the same time when not filtering by Type is not permitted - Timestamp filters (createdAfter, createdBefore) can be combined with other filters when not sorting by priority
createdAfter (datetime) --
Filter for tasks created after this timestamp inclusive
createdBefore (datetime) --
Filter for tasks created before this timestamp exclusive
priority (list) --
Filter by priority (single value only)
(string) --
Priority levels for tasks, from highest to lowest urgency
status (list) --
Filter by status (single value only)
(string) --
Possible states of a task throughout its lifecycle
taskType (list) --
Filter by task type (single value only)
(string) --
Types of tasks that can be created in the backlog
primaryTaskId (string) --
Filter by primary task ID to get linked tasks
integer
Maximum number of tasks to return in a single response (1-1000, default: 100)
string
Token for retrieving the next page of results
string
Field to sort by Sorting restrictions: - Only sorting on createdAt is supported when using priority or status filters alone. - Sorting by priority is not supported when using Timestamp filters (createdAfter, createdBefore)
string
Sort order for the tasks based on sortField (default: DESC)
dict
Response Syntax
{
'tasks': [
{
'agentSpaceId': 'string',
'taskId': 'string',
'executionId': 'string',
'title': 'string',
'description': 'string',
'reference': {
'system': 'string',
'title': 'string',
'referenceId': 'string',
'referenceUrl': 'string',
'associationId': 'string'
},
'taskType': 'INVESTIGATION'|'EVALUATION'|'RELEASE_READINESS_REVIEW'|'RELEASE_TESTING',
'priority': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW'|'MINIMAL',
'status': 'PENDING_TRIAGE'|'LINKED'|'PENDING_START'|'IN_PROGRESS'|'PENDING_CUSTOMER_APPROVAL'|'COMPLETED'|'FAILED'|'TIMED_OUT'|'CANCELED'|'SKIPPED'|'WAITING',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'version': 123,
'supportMetadata': {...}|[...]|123|123.4|'string'|True|None,
'metadata': {...}|[...]|123|123.4|'string'|True|None,
'primaryTaskId': 'string',
'statusReason': 'string',
'hasLinkedTasks': True|False
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
Response structure containing a list of backlog tasks
tasks (list) --
List of backlog tasks
(dict) --
Represents a backlog task with all its properties and metadata
agentSpaceId (string) --
The unique identifier for the agent space containing this task
taskId (string) --
The unique identifier for this task
executionId (string) --
The execution ID associated with this task, if any
title (string) --
The title of the task
description (string) --
Optional detailed description of the task
reference (dict) --
Optional reference information linking this task to external systems
system (string) --
The name of the external system
title (string) --
Optional title for the reference
referenceId (string) --
The unique identifier in the external system
referenceUrl (string) --
URL to access the reference in the external system
associationId (string) --
Association identifier of the external system
taskType (string) --
The type of this task
priority (string) --
The priority level of this task
status (string) --
The current status of this task
createdAt (datetime) --
Timestamp when this task was created
updatedAt (datetime) --
Timestamp when this task was last updated
version (integer) --
Version number for optimistic locking
supportMetadata (:ref:`document<document>`) --
Optional support metadata for the task
metadata (:ref:`document<document>`) --
Optional metadata for the task
primaryTaskId (string) --
The task ID of the primary investigation this task is linked to
statusReason (string) --
Explanation for why the task status was changed (e.g., linked reason)
hasLinkedTasks (boolean) --
Indicates if this task has other tasks linked to it
nextToken (string) --
Token for retrieving the next page of results, if more results are available
{'executions': {'executionStatus': {'WAITING'}}}
List executions
See also: AWS API Documentation
Request Syntax
client.list_executions(
agentSpaceId='string',
taskId='string',
limit=123,
nextToken='string'
)
string
[REQUIRED]
The unique identifier for the agent space
string
[REQUIRED]
The unique identifier of the task whose executions to retrieve
integer
Maximum number of executions to return
string
Token for pagination to retrieve the next set of results
dict
Response Syntax
{
'executions': [
{
'agentSpaceId': 'string',
'executionId': 'string',
'parentExecutionId': 'string',
'agentSubTask': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'executionStatus': 'FAILED'|'RUNNING'|'STOPPED'|'CANCELED'|'TIMED_OUT'|'WAITING',
'agentType': 'string',
'uid': 'string'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
Response structure containing executions
executions (list) --
List of executions
(dict) --
Represents an execution instance with its lifecycle information
agentSpaceId (string) --
The unique identifier for the agent space containing this execution
executionId (string) --
The unique identifier for this execution
parentExecutionId (string) --
The identifier of the parent execution, if this is a child execution
agentSubTask (string) --
The specific subtask being executed by the agent
createdAt (datetime) --
Timestamp when this execution was created
updatedAt (datetime) --
Timestamp when this execution was last updated
executionStatus (string) --
The current status of this execution
agentType (string) --
The type of agent that performed this execution.
uid (string) --
The unique identifier for the user session associated with this execution
nextToken (string) --
Token for retrieving the next page of results, if available
{'services': {'additionalServiceDetails': {'mcpservernewrelic': {'region': {'JP'}}},
'createdAt': 'timestamp',
'updatedAt': 'timestamp'}}
List a list of registered service on the account level.
See also: AWS API Documentation
Request Syntax
client.list_services(
maxResults=123,
nextToken='string',
filterServiceType='github'|'slack'|'azure'|'azuredevops'|'dynatrace'|'servicenow'|'pagerduty'|'gitlab'|'eventChannel'|'mcpservernewrelic'|'mcpservergrafana'|'mcpserverdatadog'|'mcpserver'|'mcpserversplunk'|'azureidentity'|'mcpserversigv4'|'remoteagent'|'remoteagentsigv4'
)
integer
Maximum number of results to return in a single call.
string
Token for the next page of results.
string
Optional filter to list only services of a specific type.
dict
Response Syntax
{
'nextToken': 'string',
'services': [
{
'serviceId': 'string',
'serviceType': 'github'|'slack'|'azure'|'azuredevops'|'dynatrace'|'servicenow'|'pagerduty'|'gitlab'|'eventChannel'|'mcpservernewrelic'|'mcpservergrafana'|'mcpserverdatadog'|'mcpserver'|'mcpserversplunk'|'azureidentity'|'mcpserversigv4'|'remoteagent'|'remoteagentsigv4',
'name': 'string',
'accessibleResources': [
{...}|[...]|123|123.4|'string'|True|None,
],
'additionalServiceDetails': {
'github': {
'owner': 'string',
'ownerType': 'organization'|'user',
'targetUrl': 'string'
},
'slack': {
'teamId': 'string',
'teamName': 'string'
},
'mcpserverdatadog': {
'name': 'string',
'endpoint': 'string',
'authorizationMethod': 'oauth-client-credentials'|'oauth-3lo'|'api-key'|'bearer-token',
'description': 'string',
'apiKeyHeader': 'string'
},
'mcpserver': {
'name': 'string',
'endpoint': 'string',
'authorizationMethod': 'oauth-client-credentials'|'oauth-3lo'|'api-key'|'bearer-token',
'description': 'string',
'apiKeyHeader': 'string'
},
'servicenow': {
'instanceUrl': 'string'
},
'gitlab': {
'targetUrl': 'string',
'tokenType': 'personal'|'group',
'groupId': 'string'
},
'mcpserversplunk': {
'name': 'string',
'endpoint': 'string',
'authorizationMethod': 'oauth-client-credentials'|'oauth-3lo'|'api-key'|'bearer-token',
'description': 'string',
'apiKeyHeader': 'string'
},
'mcpservernewrelic': {
'accountId': 'string',
'region': 'US'|'EU'|'JP',
'description': 'string'
},
'azuredevops': {
'organizationName': 'string'
},
'azureidentity': {
'tenantId': 'string',
'clientId': 'string',
'webIdentityRoleArn': 'string',
'webIdentityTokenAudiences': [
'string',
]
},
'mcpservergrafana': {
'endpoint': 'string',
'authorizationMethod': 'oauth-client-credentials'|'oauth-3lo'|'api-key'|'bearer-token'
},
'pagerduty': {
'scopes': [
'string',
]
},
'mcpserversigv4': {
'name': 'string',
'endpoint': 'string',
'description': 'string',
'region': 'string',
'service': 'string',
'roleArn': 'string',
'mcpRoleArn': 'string',
'customHeaders': {
'string': 'string'
}
},
'remoteagent': {
'name': 'string',
'endpoint': 'string',
'description': 'string',
'authorizationMethod': 'oauth-client-credentials'|'api-key'|'bearer-token',
'apiKeyHeader': 'string'
},
'remoteagentsigv4': {
'name': 'string',
'endpoint': 'string',
'description': 'string',
'region': 'string',
'service': 'string',
'roleArn': 'string'
}
},
'kmsKeyArn': 'string',
'privateConnectionName': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
Output containing a list of registered services and pagination token.
nextToken (string) --
Token to retrieve the next page of results, if there are more results.
services (list) --
List of registered services.
(dict) --
Represents a registered service with its configuration and accessible resources.
serviceId (string) --
The unique identifier of a service.
serviceType (string) --
The service type e.g github or dynatrace
name (string) --
The display name of the registered service.
accessibleResources (list) --
List of accessible resources for this service.
(:ref:`document<document>`) --
additionalServiceDetails (dict) --
Additional details specific to the service type.
github (dict) --
GitHub-specific service details.
owner (string) --
The GitHub repository owner name.
ownerType (string) --
The GitHub repository owner type.
targetUrl (string) --
The GitHub Enterprise Server instance URL (absent for github.com).
slack (dict) --
Slack-specific service details.
teamId (string) --
The Slack team ID.
teamName (string) --
The Slack team name.
mcpserverdatadog (dict) --
Datadog MCP server-specific service details.
name (string) --
The MCP server name.
endpoint (string) --
The MCP server endpoint URL.
authorizationMethod (string) --
The MCP server uses this authorization method.
description (string) --
Optional description for the MCP server.
apiKeyHeader (string) --
If the MCP server uses API key authentication, these details are provided.
mcpserver (dict) --
MCP server-specific service details.
name (string) --
The MCP server name.
endpoint (string) --
The MCP server endpoint URL.
authorizationMethod (string) --
The MCP server uses this authorization method.
description (string) --
Optional description for the MCP server.
apiKeyHeader (string) --
If the MCP server uses API key authentication, these details are provided.
servicenow (dict) --
ServiceNow-specific service details.
instanceUrl (string) --
The ServiceNow instance url
gitlab (dict) --
GitLab-specific service details.
targetUrl (string) --
The GitLab instance URL.
tokenType (string) --
Type of GitLab access token
groupId (string) --
Optional GitLab group ID for group-level access tokens
mcpserversplunk (dict) --
Splunk MCP server-specific service details.
name (string) --
The MCP server name.
endpoint (string) --
The MCP server endpoint URL.
authorizationMethod (string) --
The MCP server uses this authorization method.
description (string) --
Optional description for the MCP server.
apiKeyHeader (string) --
If the MCP server uses API key authentication, these details are provided.
mcpservernewrelic (dict) --
New Relic MCP server-specific service details.
accountId (string) --
The NewRelic account ID.
region (string) --
The NewRelic region (determines API endpoint).
description (string) --
Optional user description.
azuredevops (dict) --
Azure DevOps specific service details.
organizationName (string) --
The Azure DevOps Organization name associated with the service.
azureidentity (dict) --
Azure identity details for services using Azure authentication.
tenantId (string) --
The Azure Active Directory tenant ID for the identity.
clientId (string) --
The client ID of the service principal or managed identity used for authentication.
webIdentityRoleArn (string) --
The role ARN to be assumed by DevOps Agent for requesting Web Identity Token.
webIdentityTokenAudiences (list) --
The audiences for the Web Identity Token.
(string) --
mcpservergrafana (dict) --
Grafana MCP server-specific service details.
endpoint (string) --
Grafana instance URL (e.g., https://your-instance.grafana.net)
authorizationMethod (string) --
The authz method used by the MCP server.
pagerduty (dict) --
Pagerduty service details.
scopes (list) --
The scopes that were assigned to the service
(string) --
mcpserversigv4 (dict) --
SigV4-authenticated MCP server-specific service details.
name (string) --
MCP server name.
endpoint (string) --
MCP server endpoint URL.
description (string) --
Optional description for the MCP server.
region (string) --
AWS region for SigV4 signing. Use '*' for SigV4a multi-region signing.
service (string) --
AWS service name for SigV4 signing.
roleArn (string) --
IAM role ARN to assume for SigV4 signing.
mcpRoleArn (string) --
AWS IAM role ARN.
customHeaders (dict) --
Custom headers for the SigV4 MCP server.
(string) --
HTTP header name. Allows alphanumeric characters, hyphens, and underscores.
(string) --
Value type for custom headers.
remoteagent (dict) --
Remote A2A agent-specific service details (token-based auth).
name (string) --
Name identifier for a remote A2A agent.
endpoint (string) --
HTTPS endpoint URL for a remote A2A agent.
description (string) --
Description field
authorizationMethod (string) --
The authorization method used by the remote agent.
apiKeyHeader (string) --
If the remote agent uses API key authentication, the header name.
remoteagentsigv4 (dict) --
Remote A2A agent-specific service details (SigV4 auth).
name (string) --
Name identifier for a remote A2A agent.
endpoint (string) --
HTTPS endpoint URL for a remote A2A agent.
description (string) --
Description field
region (string) --
AWS region identifier or wildcard (*) for SigV4a multi-region signing.
service (string) --
The AWS service name for SigV4 signing.
roleArn (string) --
AWS IAM role ARN.
kmsKeyArn (string) --
The ARN of the AWS Key Management Service (AWS KMS) customer managed key that's used to encrypt resources.
privateConnectionName (string) --
The name of the private connection used for VPC connectivity.
createdAt (datetime) --
The timestamp when the service was registered.
updatedAt (datetime) --
The timestamp when the service was last updated.
{'serviceDetails': {'mcpservernewrelic': {'authorizationConfig': {'apiKey': {'region': {'JP'}}}}}}
This operation registers the specified service
See also: AWS API Documentation
Request Syntax
client.register_service(
service='dynatrace'|'servicenow'|'pagerduty'|'gitlab'|'eventChannel'|'mcpservernewrelic'|'mcpservergrafana'|'mcpserverdatadog'|'mcpserver'|'mcpserversplunk'|'azureidentity'|'mcpserversigv4'|'remoteagent'|'remoteagentsigv4',
serviceDetails={
'dynatrace': {
'accountUrn': 'string',
'authorizationConfig': {
'oAuthClientCredentials': {
'clientName': 'string',
'clientId': 'string',
'exchangeParameters': {
'string': 'string'
},
'clientSecret': 'string'
}
}
},
'servicenow': {
'instanceUrl': 'string',
'authorizationConfig': {
'oAuthClientCredentials': {
'clientName': 'string',
'clientId': 'string',
'exchangeParameters': {
'string': 'string'
},
'clientSecret': 'string'
}
}
},
'mcpserverdatadog': {
'name': 'string',
'endpoint': 'string',
'description': 'string',
'authorizationConfig': {
'authorizationDiscovery': {
'returnToEndpoint': 'string'
}
}
},
'mcpserver': {
'name': 'string',
'endpoint': 'string',
'description': 'string',
'authorizationConfig': {
'oAuthClientCredentials': {
'clientName': 'string',
'clientId': 'string',
'exchangeParameters': {
'string': 'string'
},
'clientSecret': 'string',
'exchangeUrl': 'string',
'scopes': [
'string',
]
},
'oAuth3LO': {
'clientName': 'string',
'clientId': 'string',
'exchangeParameters': {
'string': 'string'
},
'returnToEndpoint': 'string',
'authorizationUrl': 'string',
'exchangeUrl': 'string',
'clientSecret': 'string',
'supportCodeChallenge': True|False,
'scopes': [
'string',
]
},
'apiKey': {
'apiKeyName': 'string',
'apiKeyValue': 'string',
'apiKeyHeader': 'string'
},
'bearerToken': {
'tokenName': 'string',
'tokenValue': 'string',
'authorizationHeader': 'string'
},
'authorizationDiscovery': {
'returnToEndpoint': 'string'
}
}
},
'gitlab': {
'targetUrl': 'string',
'tokenType': 'personal'|'group',
'tokenValue': 'string',
'groupId': 'string'
},
'mcpserversplunk': {
'name': 'string',
'endpoint': 'string',
'description': 'string',
'authorizationConfig': {
'oAuthClientCredentials': {
'clientName': 'string',
'clientId': 'string',
'exchangeParameters': {
'string': 'string'
},
'clientSecret': 'string',
'exchangeUrl': 'string',
'scopes': [
'string',
]
},
'oAuth3LO': {
'clientName': 'string',
'clientId': 'string',
'exchangeParameters': {
'string': 'string'
},
'returnToEndpoint': 'string',
'authorizationUrl': 'string',
'exchangeUrl': 'string',
'clientSecret': 'string',
'supportCodeChallenge': True|False,
'scopes': [
'string',
]
},
'apiKey': {
'apiKeyName': 'string',
'apiKeyValue': 'string',
'apiKeyHeader': 'string'
},
'bearerToken': {
'tokenName': 'string',
'tokenValue': 'string',
'authorizationHeader': 'string'
},
'authorizationDiscovery': {
'returnToEndpoint': 'string'
}
}
},
'mcpservernewrelic': {
'authorizationConfig': {
'apiKey': {
'apiKey': 'string',
'accountId': 'string',
'region': 'US'|'EU'|'JP',
'applicationIds': [
'string',
],
'entityGuids': [
'string',
],
'alertPolicyIds': [
'string',
]
}
}
},
'eventChannel': {
'type': 'webhook'
},
'mcpservergrafana': {
'name': 'string',
'endpoint': 'string',
'description': 'string',
'authorizationConfig': {
'oAuthClientCredentials': {
'clientName': 'string',
'clientId': 'string',
'exchangeParameters': {
'string': 'string'
},
'clientSecret': 'string',
'exchangeUrl': 'string',
'scopes': [
'string',
]
},
'oAuth3LO': {
'clientName': 'string',
'clientId': 'string',
'exchangeParameters': {
'string': 'string'
},
'returnToEndpoint': 'string',
'authorizationUrl': 'string',
'exchangeUrl': 'string',
'clientSecret': 'string',
'supportCodeChallenge': True|False,
'scopes': [
'string',
]
},
'apiKey': {
'apiKeyName': 'string',
'apiKeyValue': 'string',
'apiKeyHeader': 'string'
},
'bearerToken': {
'tokenName': 'string',
'tokenValue': 'string',
'authorizationHeader': 'string'
},
'authorizationDiscovery': {
'returnToEndpoint': 'string'
}
}
},
'pagerduty': {
'scopes': [
'string',
],
'authorizationConfig': {
'oAuthClientCredentials': {
'clientName': 'string',
'clientId': 'string',
'exchangeParameters': {
'string': 'string'
},
'clientSecret': 'string'
}
}
},
'azureidentity': {
'tenantId': 'string',
'clientId': 'string',
'webIdentityRoleArn': 'string',
'webIdentityTokenAudiences': [
'string',
]
},
'mcpserversigv4': {
'name': 'string',
'endpoint': 'string',
'description': 'string',
'authorizationConfig': {
'region': 'string',
'service': 'string',
'roleArn': 'string',
'mcpRoleArn': 'string',
'customHeaders': {
'string': 'string'
}
}
},
'remoteagent': {
'name': 'string',
'endpoint': 'string',
'description': 'string',
'authorizationConfig': {
'apiKey': {
'apiKeyName': 'string',
'apiKeyValue': 'string',
'apiKeyHeader': 'string'
},
'oAuthClientCredentials': {
'clientName': 'string',
'clientId': 'string',
'exchangeParameters': {
'string': 'string'
},
'clientSecret': 'string',
'exchangeUrl': 'string',
'scopes': [
'string',
]
},
'bearerToken': {
'tokenName': 'string',
'tokenValue': 'string',
'authorizationHeader': 'string'
}
}
},
'remoteagentsigv4': {
'name': 'string',
'endpoint': 'string',
'description': 'string',
'authorizationConfig': {
'region': 'string',
'service': 'string',
'roleArn': 'string'
}
}
},
kmsKeyArn='string',
privateConnectionName='string',
targetUrlPrivateConnectionName='string',
exchangeUrlPrivateConnectionName='string',
name='string',
tags={
'string': 'string'
}
)
string
[REQUIRED]
Services that can be registered via the post-registration API (excludes OAuth 3LO services).
dict
[REQUIRED]
Service-specific authorization configuration parameters
dynatrace (dict) --
Dynatrace-specific service details.
accountUrn (string) -- [REQUIRED]
Dynatrace resource account urn.
authorizationConfig (dict) --
Dynatrace OAuth client credentials configuration. Use this when registering with OAuth client credentials flow.
oAuthClientCredentials (dict) --
OAuth client credentials configuration.
clientName (string) --
User friendly OAuth client name specified by end user.
clientId (string) -- [REQUIRED]
OAuth client ID for authenticating with the service.
exchangeParameters (dict) --
OAuth token exchange parameters for authenticating with the service.
(string) --
(string) --
Exchange Parameter value for MCP authentication
clientSecret (string) -- [REQUIRED]
OAuth client secret for authenticating with the service.
servicenow (dict) --
ServiceNow-specific service details.
instanceUrl (string) -- [REQUIRED]
ServiceNow instance URL.
authorizationConfig (dict) --
ServiceNow OAuth client credentials configuration. Use this when registering with OAuth client credentials flow.
oAuthClientCredentials (dict) --
OAuth client credentials configuration.
clientName (string) --
User friendly OAuth client name specified by end user.
clientId (string) -- [REQUIRED]
OAuth client ID for authenticating with the service.
exchangeParameters (dict) --
OAuth token exchange parameters for authenticating with the service.
(string) --
(string) --
Exchange Parameter value for MCP authentication
clientSecret (string) -- [REQUIRED]
OAuth client secret for authenticating with the service.
mcpserverdatadog (dict) --
Datadog MCP server-specific service details.
name (string) -- [REQUIRED]
MCP server name.
endpoint (string) -- [REQUIRED]
MCP server endpoint URL.
description (string) --
Optional description for the MCP server.
authorizationConfig (dict) -- [REQUIRED]
Datadog MCP server authorization configuration (only authorization discovery is supported).
authorizationDiscovery (dict) --
Datadog MCP server authorization discovery configuration.
returnToEndpoint (string) -- [REQUIRED]
The endpoint to return to after OAuth flow completes (must be AWS console domain)
mcpserver (dict) --
MCP server-specific service details.
name (string) -- [REQUIRED]
MCP server name.
endpoint (string) -- [REQUIRED]
MCP server endpoint URL.
description (string) --
Optional description for the MCP server.
authorizationConfig (dict) -- [REQUIRED]
MCP server authorization configuration.
oAuthClientCredentials (dict) --
MCP server configuration with OAuth client credentials.
clientName (string) --
User friendly OAuth client name specified by end user.
clientId (string) -- [REQUIRED]
OAuth client ID for authenticating with the service.
exchangeParameters (dict) --
OAuth token exchange parameters for authenticating with the service.
(string) --
(string) --
Exchange Parameter value for MCP authentication
clientSecret (string) -- [REQUIRED]
OAuth client secret for authenticating with the service.
exchangeUrl (string) -- [REQUIRED]
OAuth token exchange URL.
scopes (list) --
OAuth scopes for 3LO authentication. The service will always request scope offline_access.
(string) --
OAuth scope parameter
oAuth3LO (dict) --
MCP server configuration with OAuth 3LO.
clientName (string) --
User friendly OAuth client name specified by end user.
clientId (string) -- [REQUIRED]
OAuth client ID for authenticating with the service.
exchangeParameters (dict) --
OAuth token exchange parameters for authenticating with the service.
(string) --
(string) --
Exchange Parameter value for MCP authentication
returnToEndpoint (string) -- [REQUIRED]
The endpoint to return to after OAuth flow completes (must be AWS console domain)
authorizationUrl (string) -- [REQUIRED]
OAuth authorization URL for 3LO authentication.
exchangeUrl (string) -- [REQUIRED]
OAuth token exchange URL.
clientSecret (string) --
OAuth client secret for authenticating with the service. Required for confidential clients or when PKCE is not supported. Optional for public clients using PKCE.
supportCodeChallenge (boolean) --
Whether the service supports PKCE (Proof Key for Code Exchange) for enhanced security during the OAuth flow.
scopes (list) --
OAuth scopes for 3LO authentication. The service will always request scope offline_access.
(string) --
OAuth scope parameter
apiKey (dict) --
MCP server configuration with API key authentication.
apiKeyName (string) -- [REQUIRED]
User friendly API key name specified by end user.
apiKeyValue (string) -- [REQUIRED]
API key value for authenticating with the service.
apiKeyHeader (string) -- [REQUIRED]
HTTP header name to send the API key in requests to the service.
bearerToken (dict) --
MCP server configuration with Bearer token (RFC 6750).
tokenName (string) -- [REQUIRED]
User friendly bearer token name specified by end user.
tokenValue (string) -- [REQUIRED]
Bearer token value in alphanumeric for authenticating with the service.
authorizationHeader (string) --
HTTP header name to send the bearer token in requests to the service. Defaults to 'Authorization' per RFC 6750.
authorizationDiscovery (dict) --
MCP server authorization discovery configuration.
returnToEndpoint (string) -- [REQUIRED]
The endpoint to return to after OAuth flow completes (must be AWS console domain)
gitlab (dict) --
GitLab-specific service details.
targetUrl (string) -- [REQUIRED]
GitLab instance URL (e.g., https://gitlab.com or self-hosted instance).
tokenType (string) -- [REQUIRED]
Type of GitLab access token
tokenValue (string) -- [REQUIRED]
GitLab access token value
groupId (string) --
Optional GitLab group ID for group-level access tokens
mcpserversplunk (dict) --
Splunk MCP server-specific service details.
name (string) -- [REQUIRED]
MCP server name.
endpoint (string) -- [REQUIRED]
MCP server endpoint URL.
description (string) --
Optional description for the MCP server.
authorizationConfig (dict) -- [REQUIRED]
MCP server authorization configuration.
oAuthClientCredentials (dict) --
MCP server configuration with OAuth client credentials.
clientName (string) --
User friendly OAuth client name specified by end user.
clientId (string) -- [REQUIRED]
OAuth client ID for authenticating with the service.
exchangeParameters (dict) --
OAuth token exchange parameters for authenticating with the service.
(string) --
(string) --
Exchange Parameter value for MCP authentication
clientSecret (string) -- [REQUIRED]
OAuth client secret for authenticating with the service.
exchangeUrl (string) -- [REQUIRED]
OAuth token exchange URL.
scopes (list) --
OAuth scopes for 3LO authentication. The service will always request scope offline_access.
(string) --
OAuth scope parameter
oAuth3LO (dict) --
MCP server configuration with OAuth 3LO.
clientName (string) --
User friendly OAuth client name specified by end user.
clientId (string) -- [REQUIRED]
OAuth client ID for authenticating with the service.
exchangeParameters (dict) --
OAuth token exchange parameters for authenticating with the service.
(string) --
(string) --
Exchange Parameter value for MCP authentication
returnToEndpoint (string) -- [REQUIRED]
The endpoint to return to after OAuth flow completes (must be AWS console domain)
authorizationUrl (string) -- [REQUIRED]
OAuth authorization URL for 3LO authentication.
exchangeUrl (string) -- [REQUIRED]
OAuth token exchange URL.
clientSecret (string) --
OAuth client secret for authenticating with the service. Required for confidential clients or when PKCE is not supported. Optional for public clients using PKCE.
supportCodeChallenge (boolean) --
Whether the service supports PKCE (Proof Key for Code Exchange) for enhanced security during the OAuth flow.
scopes (list) --
OAuth scopes for 3LO authentication. The service will always request scope offline_access.
(string) --
OAuth scope parameter
apiKey (dict) --
MCP server configuration with API key authentication.
apiKeyName (string) -- [REQUIRED]
User friendly API key name specified by end user.
apiKeyValue (string) -- [REQUIRED]
API key value for authenticating with the service.
apiKeyHeader (string) -- [REQUIRED]
HTTP header name to send the API key in requests to the service.
bearerToken (dict) --
MCP server configuration with Bearer token (RFC 6750).
tokenName (string) -- [REQUIRED]
User friendly bearer token name specified by end user.
tokenValue (string) -- [REQUIRED]
Bearer token value in alphanumeric for authenticating with the service.
authorizationHeader (string) --
HTTP header name to send the bearer token in requests to the service. Defaults to 'Authorization' per RFC 6750.
authorizationDiscovery (dict) --
MCP server authorization discovery configuration.
returnToEndpoint (string) -- [REQUIRED]
The endpoint to return to after OAuth flow completes (must be AWS console domain)
mcpservernewrelic (dict) --
New Relic-specific service details.
authorizationConfig (dict) -- [REQUIRED]
New Relic MCP server authorization configuration.
apiKey (dict) --
New Relic API Key authentication (apiKey, accountId, region).
apiKey (string) -- [REQUIRED]
New Relic User API Key
accountId (string) -- [REQUIRED]
New Relic Account ID
region (string) -- [REQUIRED]
New Relic region (US or EU)
applicationIds (list) --
List of monitored APM application IDs in New Relic
(string) --
entityGuids (list) --
List of globally unique IDs for New Relic resources (apps, hosts, services)
(string) --
alertPolicyIds (list) --
List of alert policy IDs grouping related conditions
(string) --
eventChannel (dict) --
Event Channel specific service details.
type (string) --
The type of event channel
mcpservergrafana (dict) --
Datadog MCP server-specific service details.
name (string) -- [REQUIRED]
MCP server name.
endpoint (string) -- [REQUIRED]
MCP server endpoint URL.
description (string) --
Optional description for the MCP server.
authorizationConfig (dict) -- [REQUIRED]
Grafana MCP server authorization configuration (experimental).
oAuthClientCredentials (dict) --
MCP server configuration with OAuth client credentials.
clientName (string) --
User friendly OAuth client name specified by end user.
clientId (string) -- [REQUIRED]
OAuth client ID for authenticating with the service.
exchangeParameters (dict) --
OAuth token exchange parameters for authenticating with the service.
(string) --
(string) --
Exchange Parameter value for MCP authentication
clientSecret (string) -- [REQUIRED]
OAuth client secret for authenticating with the service.
exchangeUrl (string) -- [REQUIRED]
OAuth token exchange URL.
scopes (list) --
OAuth scopes for 3LO authentication. The service will always request scope offline_access.
(string) --
OAuth scope parameter
oAuth3LO (dict) --
MCP server configuration with OAuth 3LO.
clientName (string) --
User friendly OAuth client name specified by end user.
clientId (string) -- [REQUIRED]
OAuth client ID for authenticating with the service.
exchangeParameters (dict) --
OAuth token exchange parameters for authenticating with the service.
(string) --
(string) --
Exchange Parameter value for MCP authentication
returnToEndpoint (string) -- [REQUIRED]
The endpoint to return to after OAuth flow completes (must be AWS console domain)
authorizationUrl (string) -- [REQUIRED]
OAuth authorization URL for 3LO authentication.
exchangeUrl (string) -- [REQUIRED]
OAuth token exchange URL.
clientSecret (string) --
OAuth client secret for authenticating with the service. Required for confidential clients or when PKCE is not supported. Optional for public clients using PKCE.
supportCodeChallenge (boolean) --
Whether the service supports PKCE (Proof Key for Code Exchange) for enhanced security during the OAuth flow.
scopes (list) --
OAuth scopes for 3LO authentication. The service will always request scope offline_access.
(string) --
OAuth scope parameter
apiKey (dict) --
MCP server configuration with API key authentication.
apiKeyName (string) -- [REQUIRED]
User friendly API key name specified by end user.
apiKeyValue (string) -- [REQUIRED]
API key value for authenticating with the service.
apiKeyHeader (string) -- [REQUIRED]
HTTP header name to send the API key in requests to the service.
bearerToken (dict) --
MCP server configuration with Bearer token (RFC 6750).
tokenName (string) -- [REQUIRED]
User friendly bearer token name specified by end user.
tokenValue (string) -- [REQUIRED]
Bearer token value in alphanumeric for authenticating with the service.
authorizationHeader (string) --
HTTP header name to send the bearer token in requests to the service. Defaults to 'Authorization' per RFC 6750.
authorizationDiscovery (dict) --
MCP server authorization discovery configuration.
returnToEndpoint (string) -- [REQUIRED]
The endpoint to return to after OAuth flow completes (must be AWS console domain)
pagerduty (dict) --
PagerDuty specific service details.
scopes (list) -- [REQUIRED]
PagerDuty scopes.
(string) --
authorizationConfig (dict) -- [REQUIRED]
PagerDuty authorization configuration
oAuthClientCredentials (dict) --
OAuth client credentials configuration.
clientName (string) --
User friendly OAuth client name specified by end user.
clientId (string) -- [REQUIRED]
OAuth client ID for authenticating with the service.
exchangeParameters (dict) --
OAuth token exchange parameters for authenticating with the service.
(string) --
(string) --
Exchange Parameter value for MCP authentication
clientSecret (string) -- [REQUIRED]
OAuth client secret for authenticating with the service.
azureidentity (dict) --
Azure integration with AWS Outbound Identity Federation specific service details.
tenantId (string) -- [REQUIRED]
The Azure Active Directory tenant ID for the identity.
clientId (string) -- [REQUIRED]
The client ID of the service principal or managed identity used for authentication.
webIdentityRoleArn (string) -- [REQUIRED]
The role ARN to be assumed by DevOps Agent for requesting Web Identity Token.
webIdentityTokenAudiences (list) -- [REQUIRED]
The audiences for the Web Identity Token.
(string) --
mcpserversigv4 (dict) --
SigV4-authenticated MCP server-specific service details.
name (string) -- [REQUIRED]
MCP server name.
endpoint (string) -- [REQUIRED]
MCP server endpoint URL.
description (string) --
Optional description for the MCP server.
authorizationConfig (dict) -- [REQUIRED]
MCP Server SigV4 authorization configuration.
region (string) -- [REQUIRED]
AWS region for SigV4 signing. Use '*' for SigV4a multi-region signing.
service (string) -- [REQUIRED]
AWS service name for SigV4 signing.
roleArn (string) --
Deprecated — use mcpRoleArn instead. IAM role ARN to assume for SigV4 signing.
mcpRoleArn (string) --
IAM role ARN to assume for SigV4 signing. Optional — when omitted, credentials are resolved at runtime via a monitor account association.
customHeaders (dict) --
Custom headers for the SigV4 MCP server.
(string) --
HTTP header name. Allows alphanumeric characters, hyphens, and underscores.
(string) --
Value type for custom headers.
remoteagent (dict) --
Remote A2A agent service details (token-based auth).
name (string) -- [REQUIRED]
Name identifier for a remote A2A agent.
endpoint (string) -- [REQUIRED]
HTTPS endpoint URL for a remote A2A agent.
description (string) --
Description field
authorizationConfig (dict) -- [REQUIRED]
Remote agent authorization configuration.
apiKey (dict) --
Remote agent configuration with API key authentication.
apiKeyName (string) -- [REQUIRED]
User friendly API key name specified by end user.
apiKeyValue (string) -- [REQUIRED]
API key value for authenticating with the service.
apiKeyHeader (string) -- [REQUIRED]
HTTP header name to send the API key in requests to the service.
oAuthClientCredentials (dict) --
Remote agent configuration with OAuth client credentials.
clientName (string) --
User friendly OAuth client name specified by end user.
clientId (string) -- [REQUIRED]
OAuth client ID for authenticating with the service.
exchangeParameters (dict) --
OAuth token exchange parameters for authenticating with the service.
(string) --
(string) --
Exchange Parameter value for MCP authentication
clientSecret (string) -- [REQUIRED]
OAuth client secret for authenticating with the service.
exchangeUrl (string) -- [REQUIRED]
OAuth token exchange URL.
scopes (list) --
OAuth scopes for authentication.
(string) --
OAuth scope parameter
bearerToken (dict) --
Remote agent configuration with Bearer token (RFC 6750).
tokenName (string) -- [REQUIRED]
User friendly bearer token name specified by end user.
tokenValue (string) -- [REQUIRED]
Bearer token value in alphanumeric for authenticating with the service.
authorizationHeader (string) --
HTTP header name to send the bearer token in requests to the service. Defaults to 'Authorization' per RFC 6750.
remoteagentsigv4 (dict) --
Remote A2A agent service details (SigV4 auth).
name (string) -- [REQUIRED]
Name identifier for a remote A2A agent.
endpoint (string) -- [REQUIRED]
HTTPS endpoint URL for a remote A2A agent.
description (string) --
Description field
authorizationConfig (dict) -- [REQUIRED]
Remote agent SigV4 authorization configuration.
region (string) -- [REQUIRED]
AWS region identifier or wildcard (*) for SigV4a multi-region signing.
service (string) -- [REQUIRED]
The AWS service name for SigV4 signing.
roleArn (string) --
AWS IAM role ARN.
string
The ARN of the AWS Key Management Service (AWS KMS) customer managed key that's used to encrypt resources.
string
The name of the private connection to use for VPC connectivity.
string
The name of the private connection to use for API calls (target URL) only. Cannot be specified when privateConnectionName is provided.
string
The name of the private connection to use for OAuth token exchange requests only. Cannot be specified when privateConnectionName is provided.
string
The display name for the service registration.
dict
Tags to add to the Service at registration time.
(string) --
Tag key string.
(string) --
Tag value string.
dict
Response Syntax
{
'serviceId': 'string',
'additionalStep': {
'oauth': {
'authorizationUrl': 'string'
}
},
'kmsKeyArn': 'string',
'tags': {
'string': 'string'
}
}
Response Structure
(dict) --
Output containing the service ID and any additional steps required for registration.
serviceId (string) --
Service ID - present when registration is complete, absent when additional steps are required
additionalStep (dict) --
Indicates if additional steps are required to complete service registration (e.g., 3-legged OAuth)
oauth (dict) --
OAuth authorization step required.
authorizationUrl (string) --
The URL to redirect the user to for OAuth authorization.
kmsKeyArn (string) --
The ARN of the AWS Key Management Service (AWS KMS) customer managed key that's used to encrypt resources.
tags (dict) --
Tags associated with the registered Service.
(string) --
Tag key string.
(string) --
Tag value string.
{'context': {'approvalAction': {'action': 'APPROVED | REJECTED',
'approvalId': 'string',
'buttonText': 'string',
'interruptId': 'string',
'toolUseId': 'string'}},
'modelTier': 'string'}
Sends a chat message and streams the response for the specified agent space execution
See also: AWS API Documentation
Request Syntax
client.send_message(
agentSpaceId='string',
executionId='string',
content='string',
context={
'currentPage': 'string',
'lastMessage': 'string',
'userActionResponse': 'string',
'approvalAction': {
'toolUseId': 'string',
'interruptId': 'string',
'approvalId': 'string',
'buttonText': 'string',
'action': 'APPROVED'|'REJECTED'
}
},
userId='string',
assetIds=[
'string',
],
modelTier='string'
)
string
[REQUIRED]
The agent space identifier
string
[REQUIRED]
The execution identifier for the chat session
string
[REQUIRED]
The user message content
dict
Optional context for the message
currentPage (string) --
The current page or view the user is on
lastMessage (string) --
The ID of the last message in the conversation
userActionResponse (string) --
Response to a UI prompt (not a text conversation message). Set this to the sentinel value "APPROVAL_ACTION" when the request is resuming a paused execution after an approval decision; in that case the structured decision is provided on the sibling approvalAction member. Preserved as a String for backward compatibility: clients that predate the typed approval field may still encode UI-prompt responses as JSON in this field.
approvalAction (dict) --
An approval decision supplied when resuming a paused agent execution. When an agent execution pauses to request approval for an elevated action, SendMessage streams an approval request carrying interrupt identifiers. To resume the paused execution, call SendMessage again with userActionResponse set to "APPROVAL_ACTION" and this member populated with those identifiers and the decision (APPROVED or REJECTED). Optional; omit it for messages that are not resuming an approval.
toolUseId (string) --
Identifier of the specific paused tool invocation that requested approval. Correlates the approval decision back to the paused invocation.
interruptId (string) --
An opaque resume identifier issued by the service when an agent execution pauses for approval. Provide it when resuming so the service can resume the correct paused execution.
approvalId (string) --
Identifier of the approval request being resolved.
buttonText (string) --
Optional display text of the UI control the user chose (for example, "Approve Exact", "Approve Broader", or "Reject"), provided as auxiliary decision context.
action (string) --
The action taken on the approval request — APPROVED or REJECTED.
string
User identifier. This field is deprecated and will be ignored — the service resolves user identity from the authenticated session.
list
Optional list of asset identifiers to attach to the message
(string) --
string
Optional model tier selection. Valid values: smart, balanced, fast. Absent or unrecognized values default to balanced.
dict
The response of this operation contains an :class:`.EventStream` member. When iterated the :class:`.EventStream` will yield events based on the structure below, where only one of the top level keys will be present for any given event.
Response Syntax
{
'events': EventStream({
'responseCreated': {
'responseId': 'string',
'sequenceNumber': 123
},
'responseInProgress': {
'responseId': 'string',
'sequenceNumber': 123
},
'responseCompleted': {
'responseId': 'string',
'usage': {
'inputTokens': 123,
'outputTokens': 123,
'totalTokens': 123
},
'sequenceNumber': 123
},
'responseFailed': {
'responseId': 'string',
'errorCode': 'string',
'errorMessage': 'string',
'sequenceNumber': 123
},
'summary': {
'content': 'string',
'sequenceNumber': 123
},
'heartbeat': {},
'contentBlockStart': {
'index': 123,
'type': 'string',
'id': 'string',
'parentId': 'string',
'sequenceNumber': 123
},
'contentBlockDelta': {
'index': 123,
'delta': {
'textDelta': {
'text': 'string'
},
'jsonDelta': {
'partialJson': 'string'
}
},
'sequenceNumber': 123
},
'contentBlockStop': {
'index': 123,
'type': 'string',
'text': 'string',
'last': True|False,
'sequenceNumber': 123
}
})
}
Response Structure
(dict) --
Response structure for sending chat message events
events (:class:`.EventStream`) --
The stream of chat message events
responseCreated (dict) --
Emitted when the response is created
responseId (string) --
The response ID
sequenceNumber (integer) --
Event sequence number
responseInProgress (dict) --
Emitted while the response is being generated
responseId (string) --
The response ID
sequenceNumber (integer) --
Event sequence number
responseCompleted (dict) --
Emitted when the response completes successfully
responseId (string) --
The response ID
usage (dict) --
Token usage information
inputTokens (integer) --
Number of input tokens
outputTokens (integer) --
Number of output tokens
totalTokens (integer) --
Total tokens used
sequenceNumber (integer) --
Event sequence number
responseFailed (dict) --
Emitted when the response fails
responseId (string) --
The response ID
errorCode (string) --
Error code
errorMessage (string) --
Error message
sequenceNumber (integer) --
Event sequence number
summary (dict) --
Emitted to provide a summary of agent actions
content (string) --
Summary content
sequenceNumber (integer) --
Event sequence number
heartbeat (:class:`.EventStream`) --
Heartbeat event sent periodically to keep the connection alive during idle periods
contentBlockStart (dict) --
Emitted when a new content block starts
index (integer) --
Zero-based index of the content block
type (string) --
The type of content in this block
id (string) --
Block identifier
parentId (string) --
Optional parent block ID for nested content blocks (e.g. subagent tool calls)
sequenceNumber (integer) --
Event sequence number
contentBlockDelta (dict) --
Emitted for each incremental content delta within a content block
index (integer) --
Zero-based index of the content block
delta (dict) --
The incremental content delta
textDelta (dict) --
Text delta for text-based content blocks
text (string) --
The text fragment
jsonDelta (dict) --
JSON delta for structured content blocks
partialJson (string) --
Partial JSON string
sequenceNumber (integer) --
Event sequence number
contentBlockStop (dict) --
Emitted when a content block is complete
index (integer) --
Zero-based index of the content block
type (string) --
The type of content in this block
text (string) --
The accumulated complete content text
last (boolean) --
Whether this is the final content block in the response
sequenceNumber (integer) --
Event sequence number
{'preferences': {'elevatedActionsEnabled': 'boolean'}}
Response {'agentSpace': {'preferences': {'elevatedActionsEnabled': 'boolean'}}}
Updates the information of an existing AgentSpace.
See also: AWS API Documentation
Request Syntax
client.update_agent_space(
agentSpaceId='string',
name='string',
description='string',
locale='string',
preferences={
'string': True|False
}
)
string
[REQUIRED]
The unique identifier of the AgentSpace
string
The updated name of the AgentSpace.
string
The updated description of the AgentSpace.
string
The updated locale for the AgentSpace, which determines the language used in agent responses.
dict
The preferences to configure on the agent space. When provided, this replaces the full set of configured preferences; preferences not included revert to their default values. When omitted, the current preferences are left unchanged.
(string) --
The key of a preference that can be configured on an agent space. The elevatedActionsEnabled key controls whether elevated directed actions are permitted in the agent space. Elevated directed actions are mutating operations that also require per-action operator approval, and default to false when not set.
(boolean) --
dict
Response Syntax
{
'agentSpace': {
'name': 'string',
'description': 'string',
'locale': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'kmsKeyArn': 'string',
'agentSpaceId': 'string',
'preferences': {
'string': True|False
}
}
}
Response Structure
(dict) --
Output containing the updated AgentSpace.
agentSpace (dict) --
Represents a complete AgentSpace with all its properties, timestamps, encryption settings, and unique identifier.
name (string) --
The name of the AgentSpace.
description (string) --
The description of the AgentSpace.
locale (string) --
The locale for the AgentSpace, which determines the language used in agent responses.
createdAt (datetime) --
The timestamp when the resource was created.
updatedAt (datetime) --
The timestamp when the resource was last updated.
kmsKeyArn (string) --
The ARN of the AWS Key Management Service (AWS KMS) customer managed key that's used to encrypt resources.
agentSpaceId (string) --
The unique identifier of the AgentSpace
preferences (dict) --
The preferences configured on the agent space. Preferences that are not set take their default values.
(string) --
The key of a preference that can be configured on an agent space. The elevatedActionsEnabled key controls whether elevated directed actions are permitted in the agent space. Elevated directed actions are mutating operations that also require per-action operator approval, and default to false when not set.
(boolean) --
{'configuration': {'aws': {'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid | invalid | '
'pending-confirmation'},
'mcpserver': {'toolDetails': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpserverdatadog': {'enabledElevatedTools': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpservergrafana': {'enabledElevatedTools': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpserversigv4': {'toolDetails': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'sourceAws': {'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid | '
'invalid | '
'pending-confirmation'}}}
Response {'association': {'configuration': {'aws': {'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid '
'| '
'invalid '
'| '
'pending-confirmation'},
'mcpserver': {'toolDetails': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpserverdatadog': {'enabledElevatedTools': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpservergrafana': {'enabledElevatedTools': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'mcpserversigv4': {'toolDetails': [{'name': 'string',
'toolClassification': 'READ_ONLY '
'| '
'MUTATIVE '
'| '
'DESTRUCTIVE'}]},
'sourceAws': {'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid '
'| '
'invalid '
'| '
'pending-confirmation'}}}}
Partially updates the configuration of an existing service association for an AgentSpace. Present fields are fully replaced; absent fields are left unchanged. Returns 200 OK on success.
See also: AWS API Documentation
Request Syntax
client.update_association(
agentSpaceId='string',
associationId='string',
configuration={
'sourceAws': {
'accountId': 'string',
'accountType': 'source',
'assumableRoleArn': 'string',
'externalId': 'string',
'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid'|'invalid'|'pending-confirmation'
},
'aws': {
'assumableRoleArn': 'string',
'accountId': 'string',
'accountType': 'monitor',
'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid'|'invalid'|'pending-confirmation'
},
'github': {
'repoName': 'string',
'repoId': 'string',
'owner': 'string',
'ownerType': 'organization'|'user',
'instanceIdentifier': 'string',
'runtimeRoleArn': 'string'
},
'slack': {
'workspaceId': 'string',
'workspaceName': 'string',
'transmissionTarget': {
'opsOncallTarget': {
'channelName': 'string',
'channelId': 'string'
},
'opsSRETarget': {
'channelName': 'string',
'channelId': 'string'
}
}
},
'dynatrace': {
'envId': 'string',
'resources': [
'string',
]
},
'servicenow': {
'instanceId': 'string',
'authScopes': [
'string',
]
},
'mcpservernewrelic': {
'accountId': 'string',
'endpoint': 'string'
},
'mcpserverdatadog': {
'enabledElevatedTools': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'mcpserver': {
'tools': [
'string',
],
'toolDetails': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'gitlab': {
'projectId': 'string',
'projectPath': 'string',
'instanceIdentifier': 'string',
'runtimeRoleArn': 'string'
},
'mcpserversplunk': {}
,
'eventChannel': {}
,
'azure': {
'subscriptionId': 'string'
},
'azuredevops': {
'organizationName': 'string',
'projectId': 'string',
'projectName': 'string'
},
'mcpservergrafana': {
'endpoint': 'string',
'organizationId': 'string',
'tools': [
'string',
],
'enabledElevatedTools': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'pagerduty': {
'services': [
'string',
],
'customerEmail': 'string'
},
'mcpserversigv4': {
'tools': [
'string',
],
'toolDetails': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'remoteagent': {}
,
'remoteagentsigv4': {}
},
capabilities={
'string': {
'enabled': True|False
}
}
)
string
[REQUIRED]
The unique identifier of the AgentSpace
string
[REQUIRED]
The unique identifier of the given association.
dict
[REQUIRED]
The configuration that directs how AgentSpace interacts with the given service. The entire configuration is replaced on update.
sourceAws (dict) --
AWS source account configuration for monitoring resources.
accountId (string) -- [REQUIRED]
AWS Account Id corresponding to provided resources.
accountType (string) -- [REQUIRED]
Account Type 'source' for AIDevOps monitoring.
assumableRoleArn (string) -- [REQUIRED]
Role ARN to be assumed by AIDevOps to operate on behalf of customer. To set this role ARN on AssociateService or UpdateAssociation, the caller must have at least the iam:PassRole permission on arn:aws:iam::<account-id>:role/* in the caller's own account, with the condition iam:PassedToService set to aidevops.amazonaws.com. A broader iam:PassRole grant also satisfies this requirement.
externalId (string) --
External ID for additional security when assuming the role. Used to prevent the confused deputy problem.
agentElevatedRoleArn (string) --
Optional IAM role ARN to be assumed by AIDevOps for elevated directed actions on behalf of the customer. Used for mutating operations gated by elevatedActionsEnabled on the AgentSpace. When not provided, only non-elevated directed actions are available for this AWS account. Setting this role is subject to the same minimum iam:PassRole requirement described on assumableRoleArn.
agentElevatedRoleArnStatus (string) --
Validation status of the agentElevatedRoleArn. Updated asynchronously after the customer registers an elevated role. Possible values: PENDING_CONFIRMATION (validation in progress), VALID (role validated), INVALID (validation failed).
aws (dict) --
AWS monitor account configuration.
assumableRoleArn (string) -- [REQUIRED]
Role ARN to be assumed by AIDevOps to operate on behalf of customer.
accountId (string) -- [REQUIRED]
AWS Account Id corresponding to provided resources.
accountType (string) -- [REQUIRED]
Account Type 'monitor' for AIDevOps monitoring.
agentElevatedRoleArn (string) --
Optional IAM role ARN to be assumed by AIDevOps for elevated directed actions on behalf of the customer. Used for mutating operations gated by elevatedActionsEnabled on the AgentSpace. When not provided, only non-elevated directed actions are available for this AWS account.
agentElevatedRoleArnStatus (string) --
Validation status of the agentElevatedRoleArn. Updated asynchronously after the customer registers an elevated role. Possible values: PENDING_CONFIRMATION (validation in progress), VALID (role validated), INVALID (validation failed).
github (dict) --
GitHub repository integration configuration.
repoName (string) -- [REQUIRED]
Associated Github repo name
repoId (string) -- [REQUIRED]
Associated Github repo ID
owner (string) -- [REQUIRED]
The GitHub repository owner name.
ownerType (string) -- [REQUIRED]
Type of GitHub repository owner.
instanceIdentifier (string) --
GitHub instance identifier (e.g., github.com or github.enterprise.com)
runtimeRoleArn (string) --
Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
slack (dict) --
Slack workspace integration configuration.
workspaceId (string) -- [REQUIRED]
Associated Slack workspace ID
workspaceName (string) -- [REQUIRED]
Associated Slack workspace name
transmissionTarget (dict) -- [REQUIRED]
Transmission targets for agent notifications
opsOncallTarget (dict) -- [REQUIRED]
Destination for On-call Agent (Ops1)
channelName (string) --
Slack channel name
channelId (string) -- [REQUIRED]
Slack channel ID
opsSRETarget (dict) --
Destination for SRE Agent (Ops1.5)
channelName (string) --
Slack channel name
channelId (string) -- [REQUIRED]
Slack channel ID
dynatrace (dict) --
Dynatrace monitoring integration configuration.
envId (string) -- [REQUIRED]
Dynatrace environment id
resources (list) --
List of Dynatrace resources to monitor
(string) --
servicenow (dict) --
ServiceNow instance integration configuration.
instanceId (string) --
ServiceNow instance ID
authScopes (list) --
Scoped down authentication scopes for fine grained control
(string) --
mcpservernewrelic (dict) --
NewRelic instance integration configuration.
accountId (string) -- [REQUIRED]
New Relic Account ID
endpoint (string) -- [REQUIRED]
MCP server endpoint URL (e.g., https://mcp.newrelic.com/mcp/)
mcpserverdatadog (dict) --
Datadog MCP server integration configuration.
enabledElevatedTools (list) --
The subset of elevated-access tools enabled for this integration.
(dict) --
An MCP tool together with its access categorization.
name (string) -- [REQUIRED]
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
mcpserver (dict) --
MCP (Model Context Protocol) server integration configuration.
tools (list) -- [REQUIRED]
List of MCP tools can be used with the association.
(string) --
toolDetails (list) --
List of MCP tools with their access categorization. When provided, the tool names must match those in the tools member.
(dict) --
An MCP tool together with its access categorization.
name (string) -- [REQUIRED]
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
gitlab (dict) --
GitLab project integration configuration.
projectId (string) -- [REQUIRED]
GitLab numeric project ID.
projectPath (string) -- [REQUIRED]
Full GitLab project path (e.g., namespace/project-name).
instanceIdentifier (string) --
GitLab instance identifier (e.g., gitlab.com or e2e.gamma.dev.us-east-1.gitlab.falco.ai.aws.dev)
runtimeRoleArn (string) --
Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
mcpserversplunk (dict) --
Splunk MCP server integration configuration.
eventChannel (dict) --
Event Channel instance integration configuration.
azure (dict) --
Azure subscription integration configuration.
subscriptionId (string) -- [REQUIRED]
Azure subscription ID corresponding to provided resources.
azuredevops (dict) --
Azure DevOps project integration configuration.
organizationName (string) -- [REQUIRED]
Azure DevOps organization name.
projectId (string) -- [REQUIRED]
Azure DevOps project ID.
projectName (string) -- [REQUIRED]
Azure DevOps project name.
mcpservergrafana (dict) --
Grafana MCP server integration configuration.
endpoint (string) -- [REQUIRED]
Grafana instance URL (e.g., https://your-instance.grafana.net)
organizationId (string) --
The Grafana organization ID that can be used.
tools (list) --
List of MCP tools that can be used.
(string) --
enabledElevatedTools (list) --
The subset of elevated-access tools enabled for this integration.
(dict) --
An MCP tool together with its access categorization.
name (string) -- [REQUIRED]
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
pagerduty (dict) --
PagerDuty integration configuration
services (list) -- [REQUIRED]
List of Pagerduty service available for the association.
(string) --
customerEmail (string) -- [REQUIRED]
Email to be used in Pagerduty API header
mcpserversigv4 (dict) --
SigV4-authenticated MCP server integration configuration.
tools (list) -- [REQUIRED]
List of MCP tools available for the association.
(string) --
toolDetails (list) --
List of MCP tools with their access categorization. When provided, the tool names must match those in the tools member.
(dict) --
An MCP tool together with its access categorization.
name (string) -- [REQUIRED]
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
remoteagent (dict) --
Remote A2A agent integration configuration (token-based auth).
remoteagentsigv4 (dict) --
Remote A2A agent integration configuration (SigV4 auth).
dict
Enabled capabilities for this association.
(string) --
AWS DevOps Agent capability types representing the set of automated capabilities that can be enabled per association.
(dict) --
Capability configuration for the AWS DevOps Agent.
enabled (boolean) --
Whether the capability is enabled.
dict
Response Syntax
{
'association': {
'agentSpaceId': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'status': 'valid'|'invalid'|'pending-confirmation',
'associationId': 'string',
'serviceId': 'string',
'configuration': {
'sourceAws': {
'accountId': 'string',
'accountType': 'source',
'assumableRoleArn': 'string',
'externalId': 'string',
'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid'|'invalid'|'pending-confirmation'
},
'aws': {
'assumableRoleArn': 'string',
'accountId': 'string',
'accountType': 'monitor',
'agentElevatedRoleArn': 'string',
'agentElevatedRoleArnStatus': 'valid'|'invalid'|'pending-confirmation'
},
'github': {
'repoName': 'string',
'repoId': 'string',
'owner': 'string',
'ownerType': 'organization'|'user',
'instanceIdentifier': 'string',
'runtimeRoleArn': 'string'
},
'slack': {
'workspaceId': 'string',
'workspaceName': 'string',
'transmissionTarget': {
'opsOncallTarget': {
'channelName': 'string',
'channelId': 'string'
},
'opsSRETarget': {
'channelName': 'string',
'channelId': 'string'
}
}
},
'dynatrace': {
'envId': 'string',
'resources': [
'string',
]
},
'servicenow': {
'instanceId': 'string',
'authScopes': [
'string',
]
},
'mcpservernewrelic': {
'accountId': 'string',
'endpoint': 'string'
},
'mcpserverdatadog': {
'enabledElevatedTools': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'mcpserver': {
'tools': [
'string',
],
'toolDetails': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'gitlab': {
'projectId': 'string',
'projectPath': 'string',
'instanceIdentifier': 'string',
'runtimeRoleArn': 'string'
},
'mcpserversplunk': {},
'eventChannel': {},
'azure': {
'subscriptionId': 'string'
},
'azuredevops': {
'organizationName': 'string',
'projectId': 'string',
'projectName': 'string'
},
'mcpservergrafana': {
'endpoint': 'string',
'organizationId': 'string',
'tools': [
'string',
],
'enabledElevatedTools': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'pagerduty': {
'services': [
'string',
],
'customerEmail': 'string'
},
'mcpserversigv4': {
'tools': [
'string',
],
'toolDetails': [
{
'name': 'string',
'toolClassification': 'READ_ONLY'|'MUTATIVE'|'DESTRUCTIVE'
},
]
},
'remoteagent': {},
'remoteagentsigv4': {}
},
'capabilities': {
'string': {
'enabled': True|False
}
}
},
'webhook': {
'webhookUrl': 'string',
'webhookId': 'string',
'webhookType': 'hmac'|'apikey'|'gitlab'|'pagerduty',
'webhookSecret': 'string',
'apiKey': 'string'
}
}
Response Structure
(dict) --
Output containing the updated association and optional webhook configuration.
association (dict) --
Represents a service association within an AgentSpace, defining how the agent interacts with external services.
agentSpaceId (string) --
The unique identifier of the AgentSpace
createdAt (datetime) --
The timestamp when the resource was created.
updatedAt (datetime) --
The timestamp when the resource was last updated.
status (string) --
Validation status
associationId (string) --
The unique identifier of the given association.
serviceId (string) --
The identifier for associated service
configuration (dict) --
The configuration that directs how AgentSpace interacts with the given service.
sourceAws (dict) --
AWS source account configuration for monitoring resources.
accountId (string) --
AWS Account Id corresponding to provided resources.
accountType (string) --
Account Type 'source' for AIDevOps monitoring.
assumableRoleArn (string) --
Role ARN to be assumed by AIDevOps to operate on behalf of customer. To set this role ARN on AssociateService or UpdateAssociation, the caller must have at least the iam:PassRole permission on arn:aws:iam::<account-id>:role/* in the caller's own account, with the condition iam:PassedToService set to aidevops.amazonaws.com. A broader iam:PassRole grant also satisfies this requirement.
externalId (string) --
External ID for additional security when assuming the role. Used to prevent the confused deputy problem.
agentElevatedRoleArn (string) --
Optional IAM role ARN to be assumed by AIDevOps for elevated directed actions on behalf of the customer. Used for mutating operations gated by elevatedActionsEnabled on the AgentSpace. When not provided, only non-elevated directed actions are available for this AWS account. Setting this role is subject to the same minimum iam:PassRole requirement described on assumableRoleArn.
agentElevatedRoleArnStatus (string) --
Validation status of the agentElevatedRoleArn. Updated asynchronously after the customer registers an elevated role. Possible values: PENDING_CONFIRMATION (validation in progress), VALID (role validated), INVALID (validation failed).
aws (dict) --
AWS monitor account configuration.
assumableRoleArn (string) --
Role ARN to be assumed by AIDevOps to operate on behalf of customer.
accountId (string) --
AWS Account Id corresponding to provided resources.
accountType (string) --
Account Type 'monitor' for AIDevOps monitoring.
agentElevatedRoleArn (string) --
Optional IAM role ARN to be assumed by AIDevOps for elevated directed actions on behalf of the customer. Used for mutating operations gated by elevatedActionsEnabled on the AgentSpace. When not provided, only non-elevated directed actions are available for this AWS account.
agentElevatedRoleArnStatus (string) --
Validation status of the agentElevatedRoleArn. Updated asynchronously after the customer registers an elevated role. Possible values: PENDING_CONFIRMATION (validation in progress), VALID (role validated), INVALID (validation failed).
github (dict) --
GitHub repository integration configuration.
repoName (string) --
Associated Github repo name
repoId (string) --
Associated Github repo ID
owner (string) --
The GitHub repository owner name.
ownerType (string) --
Type of GitHub repository owner.
instanceIdentifier (string) --
GitHub instance identifier (e.g., github.com or github.enterprise.com)
runtimeRoleArn (string) --
Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
slack (dict) --
Slack workspace integration configuration.
workspaceId (string) --
Associated Slack workspace ID
workspaceName (string) --
Associated Slack workspace name
transmissionTarget (dict) --
Transmission targets for agent notifications
opsOncallTarget (dict) --
Destination for On-call Agent (Ops1)
channelName (string) --
Slack channel name
channelId (string) --
Slack channel ID
opsSRETarget (dict) --
Destination for SRE Agent (Ops1.5)
channelName (string) --
Slack channel name
channelId (string) --
Slack channel ID
dynatrace (dict) --
Dynatrace monitoring integration configuration.
envId (string) --
Dynatrace environment id
resources (list) --
List of Dynatrace resources to monitor
(string) --
servicenow (dict) --
ServiceNow instance integration configuration.
instanceId (string) --
ServiceNow instance ID
authScopes (list) --
Scoped down authentication scopes for fine grained control
(string) --
mcpservernewrelic (dict) --
NewRelic instance integration configuration.
accountId (string) --
New Relic Account ID
endpoint (string) --
MCP server endpoint URL (e.g., https://mcp.newrelic.com/mcp/)
mcpserverdatadog (dict) --
Datadog MCP server integration configuration.
enabledElevatedTools (list) --
The subset of elevated-access tools enabled for this integration.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
mcpserver (dict) --
MCP (Model Context Protocol) server integration configuration.
tools (list) --
List of MCP tools can be used with the association.
(string) --
toolDetails (list) --
List of MCP tools with their access categorization. When provided, the tool names must match those in the tools member.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
gitlab (dict) --
GitLab project integration configuration.
projectId (string) --
GitLab numeric project ID.
projectPath (string) --
Full GitLab project path (e.g., namespace/project-name).
instanceIdentifier (string) --
GitLab instance identifier (e.g., gitlab.com or e2e.gamma.dev.us-east-1.gitlab.falco.ai.aws.dev)
runtimeRoleArn (string) --
Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
mcpserversplunk (dict) --
Splunk MCP server integration configuration.
eventChannel (dict) --
Event Channel instance integration configuration.
azure (dict) --
Azure subscription integration configuration.
subscriptionId (string) --
Azure subscription ID corresponding to provided resources.
azuredevops (dict) --
Azure DevOps project integration configuration.
organizationName (string) --
Azure DevOps organization name.
projectId (string) --
Azure DevOps project ID.
projectName (string) --
Azure DevOps project name.
mcpservergrafana (dict) --
Grafana MCP server integration configuration.
endpoint (string) --
Grafana instance URL (e.g., https://your-instance.grafana.net)
organizationId (string) --
The Grafana organization ID that can be used.
tools (list) --
List of MCP tools that can be used.
(string) --
enabledElevatedTools (list) --
The subset of elevated-access tools enabled for this integration.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
pagerduty (dict) --
PagerDuty integration configuration
services (list) --
List of Pagerduty service available for the association.
(string) --
customerEmail (string) --
Email to be used in Pagerduty API header
mcpserversigv4 (dict) --
SigV4-authenticated MCP server integration configuration.
tools (list) --
List of MCP tools available for the association.
(string) --
toolDetails (list) --
List of MCP tools with their access categorization. When provided, the tool names must match those in the tools member.
(dict) --
An MCP tool together with its access categorization.
name (string) --
The name of the MCP tool.
toolClassification (string) --
The access categorization of the MCP tool.
remoteagent (dict) --
Remote A2A agent integration configuration (token-based auth).
remoteagentsigv4 (dict) --
Remote A2A agent integration configuration (SigV4 auth).
capabilities (dict) --
Enabled capabilities for this association.
(string) --
AWS DevOps Agent capability types representing the set of automated capabilities that can be enabled per association.
(dict) --
Capability configuration for the AWS DevOps Agent.
enabled (boolean) --
Whether the capability is enabled.
webhook (dict) --
Generic webhook configuration
webhookUrl (string) --
The webhook URL endpoint
webhookId (string) --
The unique webhook identifier
webhookType (string) --
The webhook authentication type
webhookSecret (string) --
The webhook secret for authentication
apiKey (string) --
API Key for API Key webhook authentication
{'taskStatus': {'WAITING'}}
Response {'task': {'status': {'WAITING'}}}
Update an existing backlog task.
See also: AWS API Documentation
Request Syntax
client.update_backlog_task(
agentSpaceId='string',
taskId='string',
taskStatus='PENDING_TRIAGE'|'LINKED'|'PENDING_START'|'IN_PROGRESS'|'PENDING_CUSTOMER_APPROVAL'|'COMPLETED'|'FAILED'|'TIMED_OUT'|'CANCELED'|'SKIPPED'|'WAITING',
clientToken='string'
)
string
[REQUIRED]
The unique identifier for the agent space containing the task
string
[REQUIRED]
The unique identifier of the task to update
string
Updated task status
string
Client-provided token for idempotent operations
This field is autopopulated if not provided.
dict
Response Syntax
{
'task': {
'agentSpaceId': 'string',
'taskId': 'string',
'executionId': 'string',
'title': 'string',
'description': 'string',
'reference': {
'system': 'string',
'title': 'string',
'referenceId': 'string',
'referenceUrl': 'string',
'associationId': 'string'
},
'taskType': 'INVESTIGATION'|'EVALUATION'|'RELEASE_READINESS_REVIEW'|'RELEASE_TESTING',
'priority': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW'|'MINIMAL',
'status': 'PENDING_TRIAGE'|'LINKED'|'PENDING_START'|'IN_PROGRESS'|'PENDING_CUSTOMER_APPROVAL'|'COMPLETED'|'FAILED'|'TIMED_OUT'|'CANCELED'|'SKIPPED'|'WAITING',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1),
'version': 123,
'supportMetadata': {...}|[...]|123|123.4|'string'|True|None,
'metadata': {...}|[...]|123|123.4|'string'|True|None,
'primaryTaskId': 'string',
'statusReason': 'string',
'hasLinkedTasks': True|False
}
}
Response Structure
(dict) --
Response structure containing the updated task
task (dict) --
The updated task object
agentSpaceId (string) --
The unique identifier for the agent space containing this task
taskId (string) --
The unique identifier for this task
executionId (string) --
The execution ID associated with this task, if any
title (string) --
The title of the task
description (string) --
Optional detailed description of the task
reference (dict) --
Optional reference information linking this task to external systems
system (string) --
The name of the external system
title (string) --
Optional title for the reference
referenceId (string) --
The unique identifier in the external system
referenceUrl (string) --
URL to access the reference in the external system
associationId (string) --
Association identifier of the external system
taskType (string) --
The type of this task
priority (string) --
The priority level of this task
status (string) --
The current status of this task
createdAt (datetime) --
Timestamp when this task was created
updatedAt (datetime) --
Timestamp when this task was last updated
version (integer) --
Version number for optimistic locking
supportMetadata (:ref:`document<document>`) --
Optional support metadata for the task
metadata (:ref:`document<document>`) --
Optional metadata for the task
primaryTaskId (string) --
The task ID of the primary investigation this task is linked to
statusReason (string) --
Explanation for why the task status was changed (e.g., linked reason)
hasLinkedTasks (boolean) --
Indicates if this task has other tasks linked to it