sts · 2018-08-13

GetFederationToken

POST

Get temporary credentials for a federated user.

Wire call

Converge Cloud is RPC over HTTP. There is one path — / — and the action travels in the X-TC-Action header. The /sts/GetFederationToken path used in the OpenAPI document is a documentation convenience so each action is addressable; it is not a route on the server.

curl

curl -sS https://sts.api3.convergecloud.com/ \
  -H 'Authorization: TC3-HMAC-SHA256 Credential=<SecretId>/<YYYY-MM-DD>/sts/tc3_request, SignedHeaders=content-type;host;x-tc-action, Signature=<sig>' \
  -H 'Content-Type: application/json; charset=utf-8' \
  -H 'Host: sts.api3.convergecloud.com' \
  -H 'X-TC-Action: GetFederationToken' \
  -H 'X-TC-Version: 2018-08-13' \
  -H 'X-TC-Timestamp: <unix-seconds>' \
  -H 'X-TC-Region: luzon' \
  -d '{"Name":"<Name>","Policy":"<Policy>"}'

Request parameters

Field	Type	Required	Description
Name	string	Yes	The customizable name of the caller, consisting of letters
Policy	string	Yes	Policy description
DurationSeconds	integer	No	The validity period of temporary credentials in seconds. Default value: 1,800s. Maximum value for a root account: 7,200s. Maximum value for a sub-account: 129,600s.

Response

Fields are returned inside the Response envelope. Converge Cloud answers HTTP 200 for errors as well as successes, so read Response.Error rather than the status code — and test for the presence of that object, because Code is occasionally the empty string.

Field	Type	Description
Credentials	Credentials	Temporary credentials
ExpiredTime	integer	Temporary credentials expiration time. A Unix timestamp will be returned which is accurate to the second
Expiration	string	Credentials expiration time in UTC time in ISO 8601 format.
RequestId	string	The unique request ID, which is returned for each request. RequestId is required for locating a problem.

Success

{
  "Response": {
    "Credentials": …,
    "ExpiredTime": …,
    "RequestId": "…"
  }
}

Error

{
  "Response": {
    "Error": { "Code": "…", "Message": "…" },
    "RequestId": "…"
  }
}

Try it

CredentialThe key never leaves this tab — it signs the request here. The signed request goes to /api-relay/sts.

SecretIdSecretKey

Request bodyvalid JSONPOST sts.api3.convergecloud.com · GetFederationToken

{
  "Name": "<Name>",
  "Policy": "<Policy>"
}

This action changes resources in my own account and may create a charge. I understand.

Behaviour

Issues temporary credentials. Converge Cloud provides no revocation mechanism; the credentials remain valid until they expire.