# Alibaba Cloud IDaaS API

> Alibaba Cloud IDaaS API on Apizie: 53 endpoints (Adds an EIAM account to one or more EIAM organizations. These organizations serve as subordinate…, Adds multiple Employee Identity and Access Management (EIAM) accounts to an EIAM group. If the accounts are…, Creates a group, Creates an organizational unit, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:aliyun-eiam-developerapi`
- Category: Cloud
- Status: byok
- Source: https://api.alibabacloud.com/product/eiam-developerapi
- Page: https://zieapi.vercel.app/api/cloud/aliyun-eiam-developerapi
- OpenAPI: https://zieapi.vercel.app/api/cloud/aliyun-eiam-developerapi/openapi.json

Alibaba Cloud OpenAPI for IDaaS (eiam-developerapi, version 2022-02-25). Calls are signed with ACS3-HMAC-SHA256 using your AccessKey ID and secret.

## Endpoints

### Adds an EIAM account to one or more EIAM organizations. These organizations serve as subordinate…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/add-user-to-organizational-units` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| userId | string | yes | The account ID |
| organizationalUnitIds | array | yes | A list of organization IDs |

### Adds multiple Employee Identity and Access Management (EIAM) accounts to an EIAM group. If the accounts are…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/add-users-to-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| groupId | string | yes | The group ID |
| userIds | array | yes | The account IDs |

### Creates a group
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/create-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| groupExternalId | string | no | The external ID |
| groupName | string | yes | The organization name |

### Creates an organizational unit
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/create-organizational-unit` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| description | string | no | The description of the organizational unit |
| organizationalUnitExternalId | string | no | The external ID of the organizational unit. The external ID can be used to map external data to the data of the organizational unit in… |
| organizationalUnitName | string | yes | The name of the organizational unit |
| parentId | string | yes | The ID of the parent organizational unit |

### Creates a new EIAM account in a specified organization
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/create-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The ID of the instance |
| applicationId | string | yes | The ID of the application |
| customFields | array | no | A list of custom fields for the account |
| description | string | no | The account description. The maximum length is 256 characters |
| displayName | string | no | The display name. The maximum length is 128 characters |
| email | string | no | The email address. The local-part of the address can contain uppercase and lowercase letters, digits, periods (`.`), underscores (`_`),… |
| emailVerified | string | no | Specifies whether the email is verified. This parameter is required if `email` is set. Typically, set this to `true` |
| password | string | no | The account password. For password complexity rules, see the password policy in the IDaaS console |
| passwordInitializationConfig | object | no | The password initialization configuration |
| phoneNumber | string | no | The account phone number. It must be 6 to 15 digits long |
| phoneNumberVerified | string | no | Specifies whether the phone number is verified. This parameter is required if `phoneNumber` is set. Typically, set this to `true` |
| phoneRegion | string | no | The phone region code. For example, the code for the Chinese mainland is `86`. Do not include a `00` prefix or a plus sign (`+`). This… |
| primaryOrganizationalUnitId | string | yes | The ID of the primary organizational unit |
| userExternalId | string | no | The external user ID, used to associate the account with an external system. The maximum length is 128 characters. If unspecified, it… |
| username | string | yes | The username. It can contain letters, digits, and the following special characters: underscore (`_`), period (`.`), at sign (`@`), and… |

### Creates an account-specific credential
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/create-user-exclusive-credential` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The EIAM instance ID |
| credentialContent | object | yes | The credential content |
| credentialExternalId | string | no | The external unique identifier of the credential |
| credentialIdentifier | string | yes | The credential identifier |
| credentialName | string | yes | The credential name |
| credentialScenarioLabel | string | no | The scenarios label of the credential. Valid values: llm: large language model. saas: third-party SaaS service |
| credentialType | string | yes | The credential type. Valid values: api_key: API Key authentication credential. oauth_client: OAuth client authentication credential |
| description | string | no | The credential description |
| returnCiphertext | string | no | Specifies whether to return the encrypted ciphertext of the credential |

### Deletes a group
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/delete-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| groupId | string | yes | The group ID |

### Deletes an organizational unit
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/delete-organizational-unit` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| organizationalUnitId | string | yes | The ID of the organizational unit |

### Deletes an Employee Identity and Access Management (EIAM) account
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/delete-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| userId | string | yes | The account ID |

### Disables an Employee Identity and Access Management (EIAM) account
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/disable-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| userId | string | yes | The account ID |

### Enables an Employee Identity and Access Management (EIAM) account
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/enable-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| userId | string | yes | The account ID |

### Retrieves a valid OAuth authentication token
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/fetch-oauth-authentication-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| credentialProviderIdentifier | string | yes | The credential provider identifier |
| customParameters | object | no | Custom key-value pairs appended to the OAuth authorization URL to pass additional parameters supported by the OAuth provider |
| forceAuthentication | string | no | Specifies whether to ignore existing valid tokens and force re-authorization. Default value: false |
| scope | string | no | The scope corresponding to the OAuth protocol. If not specified, the scope of the issued OAuth Access Token defaults to the scope… |

### Generates a device code
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/generate-device-code` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| scope | string | no | The authorization scope |

### Generates a JSON Web Token (JWT) authentication token
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/generate-jwt-authentication-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | Instance ID |
| audiences | array | yes | The \`aud\` field of the JWT |
| credentialProviderIdentifier | string | yes | Credential provider identity |
| customClaims | object | no | Custom claims. Key-value pairs. Keys must be strings. |
| expiration | integer | no | The validity period of the JWT, in seconds |
| includeDerivedShortToken | string | no | Whether the generated JWT needs to include a "derived short token" |
| issuer | string | no | The \`iss\` field of the JWT |
| subject | string | yes | The \`sub\` field of the JWT |

### Generates an access token for an application in a specified IDaaS instance based on credential information
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/generate-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| client_id | string | no | The client ID |
| client_secret | string | no | The client secret. This parameter is required when \`grant\_type\` is \`client\_credentials\` and the \`client\_secret\_post\` method is… |
| grant_type | string | yes | The authorization grant type. The following types are supported: \`client\_credentials\`: Client credentials grant. Requires… |
| code | string | no | The authorization code. This parameter is required when \`grant\_type\` is \`authorization\_code\` |
| username | string | no | The username. This parameter is required for the password grant type |
| password | string | no | The username. This parameter is required for password mode |
| device_code | string | no | The device code. This parameter is required when \`grant\_type\` is \`urn:ietf:params:oauth:grant-type:device\_code\` (device flow) |
| redirect_uri | string | no | The redirection URI. This parameter is required for the authorization code grant type. It must match the redirection URI in the request to… |
| refresh_token | string | no | The refresh token. This parameter is required when \`grant\_type\` is \`refresh\_token\` (refresh token grant) |
| code_verifier | string | no | The code verifier. This is used in the authorization code grant type when PKCE is enabled |
| exclusive_tag | string | no | The excluded tag |
| scope | string | no | The scope. This parameter is optional. Multiple values are supported. Separate multiple values with spaces. Valid values: openid email… |

### The token endpoint for an instance-level authorization server
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/generate-token-by-authorization-server` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | Instance ID |
| authorizationServerId | string | yes | Authorization server ID |
| grant_type | string | yes | Grant type |
| client_id | string | yes | Client ID |
| code | string | no | Authorization code. Required when grant_type is authorization_code |
| username | string | no | Username |
| password | string | no | Password |
| device_code | string | no | Device code. Required when grant_type is urn:ietf:params:oauth:grant-type:device_code |
| redirect_uri | string | no | Redirection URI. Required when grant_type is authorization_code. Must match the redirect_uri used in the authorization code request |
| refresh_token | string | no | Refresh token |
| scope | string | no | Scope |
| code_verifier | string | no | You can validate the code |
| client_assertion | string | no | Client assertion |
| client_assertion_type | string | no | Client assertion type |
| application_federated_credential_name | string | no | Federated application credential name |
| client_x509 | string | no | Client certificate |
| client_x509_chain | string | no | Intermediate certificate list |
| client_secret | string | no | Client key |

### The GetApplicationProvisioningScope operation retrieves the synchronization scope of an application in a…
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/get-application-provisioning-scope` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |

### Retrieves the details of a group
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/get-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| groupId | string | yes | The group ID |

### Queries the current status and authorization result of an OAuth authorization session
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/get-oauth-authorization-session` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| sessionUri | string | yes | The authorization session URI. Returned by the FetchOAuthAuthenticationToken call |

### Retrieves the information about an organizational unit
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/get-organizational-unit` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| organizationalUnitId | string | yes | The ID of the organizational unit |

### Obtains the ID of an organizational unit based on the external ID
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/get-organizational-unit-id-by-external-id` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| organizationalUnitExternalId | string | yes | The external ID of the organizational unit. The external ID can be used to map external data to the data of the organizational unit in… |
| organizationalUnitSourceId | string | yes | The source ID of the organizational unit. If the organizational unit was created in IDaaS, its source ID is the ID of the IDaaS instance.… |
| organizationalUnitSourceType | string | yes | The source type of the organizational unit. Valid values: build_in: The organizational unit was created in IDaaS. ding_talk: The… |

### Retrieves the details of an Employee Identity and Access Management (EIAM) account
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/get-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| userId | string | yes | The account ID |

### Queries the ID of an Employee Identity and Access Management (EIAM) account by email address
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/get-user-id-by-email` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| email | string | yes | The email address of the user who owns the account |

### Queries the ID of an Employee Identity and Access Management (EIAM) account based on the mobile number
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/get-user-id-by-phone-number` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| phoneNumber | string | yes | The mobile number of the user who owns the account |

### Queries the ID of an Employee Identity and Access Management (EIAM) account based on the external ID
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/get-user-id-by-user-external-id` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| userExternalId | string | yes | The external ID of the account |
| userSourceId | string | yes | The source ID of the account. If the account was created in IDaaS, its source ID is the ID of the IDaaS instance. If the account was… |
| userSourceType | string | yes | The source type of the account. Valid values: build_in: The account was created in Identity as a Service (IDaaS). ding_talk: The account… |

### Queries the ID of an Employee Identity and Access Management (EIAM) account based on the username
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/get-user-id-by-username` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| username | string | yes | The username of the account |

### Retrieves the information about a user by using the user token
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/get-user-info` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |

### Lists authentication tokens
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/list-authentication-tokens` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | Instance ID |
| nextToken | string | no | Token that marks the start of the next page in a paged query |
| maxResults | integer | no | Maximum number of records to return in this paged query |
| consumerId | string | yes | ID of the authentication token consumer |
| credentialProviderIdentifier | string | yes | Credential provider identifier |
| revoked | string | no | Indicates whether the authentication token is revoked |
| expired | string | no | Indicates whether the authentication token is expired |

### Retrieves information about Employee Identity and Access Management (EIAM) groups by page
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/list-groups` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| groupNameStartWith | string | no | The prefix of the group name |
| nextToken | string | no | nextToken |
| maxResults | integer | no | The number of entries per page. Default value: 20 |

### Lists the groups that an EIAM user is a member of
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/list-groups-for-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| userId | string | yes | The user ID |
| nextToken | string | no | The token to retrieve the next page of results. Leave this parameter empty to query from the first page |
| maxResults | integer | no | The number of entries per page. Default value: 20 |

### Retrieves the information about all the parent organizational units of an organizational unit
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/list-organizational-unit-parent-ids` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| organizationalUnitId | string | yes | The ID of the organizational unit |

### Performs a paged query to retrieve organization information from EIAM
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/list-organizational-units` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| parentId | string | yes | The parent organization ID |
| pageNumber | integer | no | The page number. The default value is 1 |
| pageSize | integer | no | The number of records on each page. The default value is 20. The value can range from 1 to 100 |

### Performs a paged query for EIAM account information
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/list-users` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| organizationalUnitId | string | no | The organization ID |
| pageNumber | integer | no | The page number. The default value is 1 |
| pageSize | integer | no | The number of records to return on each page. The default value is 20. The value must be in the range of 1 to 100 |

### Queries accounts in an Employee Identity and Access Management (EIAM) group
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/list-users-for-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| groupId | string | yes | The group ID |
| nextToken | string | no | nextToken |
| maxResults | integer | no | The number of entries per page. Default value: 20 |

### Retrieves temporary access credentials for a cloud account role (CloudAccountRole)
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/obtain-cloud-account-role-access-credential` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| cloudAccountRoleExternalId | string | yes | The business identifier of the cloud account role |
| durationSeconds | integer | no | Specifies the validity duration of the temporary security credentials (STS Token) for the cloud account role, in seconds. Valid values:… |

### Queries credential information and retrieves the credential plaintext
`GET https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/obtain-credential` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The EIAM instance ID |
| credentialIdentifier | string | yes | The credential identifier |

### Obtains a JWT authentication token
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/obtain-jwt-authentication-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The ID of the instance |
| authenticationTokenId | string | yes | The ID of the authentication token |
| consumerId | string | yes | The ID of the authentication token consumer |

### Obtain a JWT authentication token using a derived short token
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/obtain-jwt-authentication-token-by-derived-short-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | Instance ID |
| derivedShortToken | string | yes | Derived short token for the JWT authentication token |

### Modifies information about an Employee Identity and Access Management (EIAM) group
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/patch-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| groupId | string | yes | The group ID |
| groupName | string | no | The group name |

### Modifies an EIAM organizational unit
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/patch-organizational-unit` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| organizationalUnitId | string | yes | The ID of the organizational unit |
| description | string | no | The description of the organizational unit |
| organizationalUnitName | string | no | The name of the organizational unit |

### Moves an organizational unit
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/patch-organizational-unit-parent-id` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| organizationalUnitId | string | yes | The organizational unit ID |
| parentId | string | yes | The ID of the parent organizational unit |

### Modifies an Employee Identity and Access Management (EIAM) account
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/patch-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| userId | string | yes | The account ID |
| customFields | array | no | The extended fields of the account |
| displayName | string | no | The display name of the account |
| email | string | no | The email address |
| emailVerified | string | no | Specifies whether the email address is verified. This field is required if an email address is specified. If you have no special… |
| phoneNumber | string | no | The mobile number |
| phoneNumberVerified | string | no | Specifies whether the mobile number is verified. This field is required if a mobile number is specified. If you have no special… |
| phoneRegion | string | no | The country code of the mobile number. For example, the country code of China is 86 without 00 or +. This parameter is required if a… |
| username | string | no | The name of the account |

### Reinstate an authentication token
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/reinstate-authentication-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| token | string | yes | The original authentication token. You can pass either the original authentication token or its derived short token |
| token_type_hint | string | no | A hint about the authentication token type. Do not provide a value for this parameter. |

### Reinstate an authentication token for a consumer
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/reinstate-authentication-token-by-consumer` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| consumerId | string | yes | The ID of the authentication token consumer |
| credentialProviderIdentifier | string | yes | The credential provider identifier |

### Removes an EIAM account from one or more EIAM organizational units. The operation succeeds even if the…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/remove-user-from-organizational-units` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| userId | string | yes | The account ID |
| organizationalUnitIds | array | yes | The organizational unit IDs |

### Removes multiple Employee Identity and Access Management (EIAM) accounts from an EIAM group. If an account…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/remove-users-from-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| groupId | string | yes | The group ID |
| userIds | array | yes | The account IDs |

### Revokes an authentication token
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/revoke-authentication-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | Instance ID |
| token | string | yes | Original authentication token. You can pass either the original authentication token or a derived short token |
| token_type_hint | string | no | Authentication token type hint. Currently, no value is required. |

### Revokes an authentication token for a consumer
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/revoke-authentication-token-by-consumer` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | Instance ID |
| consumerId | string | yes | Consumer ID of the authentication token |
| credentialProviderIdentifier | string | yes | Credential provider identifier |

### Revokes an access token or refresh token
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/revoke-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| client_id | string | no | The client ID |
| client_secret | string | no | The client secret |
| token | string | yes | The token to be revoked |
| token_type_hint | string | no | The type of the token. Valid values: access_token refresh_token |

### Sets the primary organization for an EIAM account. This operation removes the account from the old primary…
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/set-user-primary-organizational-unit` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| userId | string | yes | The account ID |
| organizationalUnitId | string | yes | The primary organization ID |

### Updates the password for a specified EIAM account
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/update-user-password` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| applicationId | string | yes | The application ID |
| userId | string | yes | The account ID |
| password | string | no | The new password. For the password requirements, see the password policy in the console |

### Validates an authentication token
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/validate-authentication-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |
| instanceId | string | yes | The instance ID |
| token | string | yes | The original authentication token. Pass either the original authentication token or a derived short token |
| token_type_hint | string | no | A hint about the type of the authentication token. No value is currently required for this parameter. |

### version
`POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/version` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam-developerapi.ap-southeast-1.aliyuncs.com |

## Example
```
curl "https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/add-user-to-organizational-units" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Alibaba Cloud IDaaS API?
Create a free Apizie key, then send POST https://zieapi.vercel.app/v1/cloud:aliyun-eiam-developerapi/add-user-to-organizational-units with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Alibaba Cloud IDaaS API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Alibaba Cloud IDaaS itself also needs your own key from aliyuncs.com.

### Can AI agents use the Alibaba Cloud IDaaS API?
Yes. Add the Apizie MCP server (https://zieapi.vercel.app/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:aliyun-eiam-developerapi.

### What is the status of the Alibaba Cloud IDaaS API?
Needs your own provider key (bring your own key)