# AWS Security Token Service API

> AWS Security Token Service API on Apizie: 8 endpoints (Returns a set of temporary security credentials that you can use to access Amazon Web Services resources.…, Returns a set of temporary security credentials for users who have been authenticated via a SAML…, Returns a set of temporary security credentials for users who have been authenticated in a mobile or web…, Decodes additional information about the authorization status of a request from an encoded message returned…, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://zieapi.vercel.app/v1/cloud:amazonaws-sts/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:amazonaws-sts`
- Category: Cloud
- Status: byok
- Source: https://github.com/mermade/aws2openapi
- Page: https://zieapi.vercel.app/api/cloud/amazonaws-sts
- OpenAPI: https://zieapi.vercel.app/api/cloud/amazonaws-sts/openapi.json

Security Token Service Security Token Service (STS) enables you to request temporary, limited-privilege credentials for users. This guide provides descriptions of the STS API. For more information about using this…

## Endpoints

### Returns a set of temporary security credentials that you can use to access Amazon Web Services resources.…
`GET https://zieapi.vercel.app/v1/cloud:amazonaws-sts/get-assume-role` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleArn | string | yes | The Amazon Resource Name (ARN) of the role to assume. |
| RoleSessionName | string | yes | An identifier for the assumed role session. Use the role session name to uniquely identify a session when the same role is assumed by… |
| PolicyArns | array | no | The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as managed session policies. The policies must exist in… |
| Policy | string | no | An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this… |
| DurationSeconds | integer | no | The duration, in seconds, of the role session. The value specified can range from 900 seconds (15 minutes) up to the maximum session… |
| Tags | array | no | A list of session tags that you want to pass. Each session tag consists of a key name and an associated value. For more information about… |
| TransitiveTagKeys | array | no | A list of keys for session tags that you want to set as transitive. If you set a tag key as transitive, the corresponding key and value… |
| ExternalId | string | no | A unique identifier that might be required when you assume a role in another account. If the administrator of the account to which the… |
| SerialNumber | string | no | The identification number of the MFA device that is associated with the user who is making the AssumeRole call. Specify this value if the… |
| TokenCode | string | no | The value provided by the MFA device, if the trust policy of the role being assumed requires MFA. (In other words, if the policy includes… |
| SourceIdentity | string | no | The source identity specified by the principal that is calling the AssumeRole operation. You can require users to specify a source… |
| ProvidedContexts | array | no | Reserved for future use. |

### Returns a set of temporary security credentials for users who have been authenticated via a SAML…
`GET https://zieapi.vercel.app/v1/cloud:amazonaws-sts/get-assume-role-with-saml` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleArn | string | yes | The Amazon Resource Name (ARN) of the role that the caller is assuming. |
| PrincipalArn | string | yes | The Amazon Resource Name (ARN) of the SAML provider in IAM that describes the IdP. |
| SAMLAssertion | string | yes | The base64 encoded SAML authentication response provided by the IdP. For more information, see Configuring a Relying Party and Adding… |
| PolicyArns | array | no | The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as managed session policies. The policies must exist in… |
| Policy | string | no | An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this… |
| DurationSeconds | integer | no | The duration, in seconds, of the role session. Your role session lasts for the duration that you specify for the DurationSeconds… |

### Returns a set of temporary security credentials for users who have been authenticated in a mobile or web…
`GET https://zieapi.vercel.app/v1/cloud:amazonaws-sts/get-assume-role-with-web-identity` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| RoleArn | string | yes | The Amazon Resource Name (ARN) of the role that the caller is assuming. |
| RoleSessionName | string | yes | An identifier for the assumed role session. Typically, you pass the name or identifier that is associated with the user who is using your… |
| WebIdentityToken | string | yes | The OAuth 2.0 access token or OpenID Connect ID token that is provided by the identity provider. Your application must get this token by… |
| ProviderId | string | no | The fully qualified host component of the domain name of the OAuth 2.0 identity provider. Do not specify this value for an OpenID Connect… |
| PolicyArns | array | no | The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as managed session policies. The policies must exist in… |
| Policy | string | no | An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this… |
| DurationSeconds | integer | no | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration… |

### Decodes additional information about the authorization status of a request from an encoded message returned…
`GET https://zieapi.vercel.app/v1/cloud:amazonaws-sts/get-decode-authorization-message` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| EncodedMessage | string | yes | The encoded message that was returned with the response. |

### Returns the account identifier for the specified access key ID. Access keys consist of two parts: an access…
`GET https://zieapi.vercel.app/v1/cloud:amazonaws-sts/get-get-access-key-info` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| AccessKeyId | string | yes | The identifier of an access key. This parameter allows (through its regex pattern) a string of characters that can consist of any upper-… |

### Returns details about the IAM user or role whose credentials are used to call the operation. No permissions…
`GET https://zieapi.vercel.app/v1/cloud:amazonaws-sts/get-get-caller-identity` (byok)

### Returns a set of temporary security credentials (consisting of an access key ID, a secret access key, and a…
`GET https://zieapi.vercel.app/v1/cloud:amazonaws-sts/get-get-federation-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| Name | string | yes | The name of the federated user. The name is used as an identifier for the temporary security credentials (such as Bob ). For example, you… |
| Policy | string | no | An IAM policy in JSON format that you want to use as an inline session policy. You must pass an inline or managed session policy to this… |
| PolicyArns | array | no | The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use as a managed session policy. The policies must exist in… |
| DurationSeconds | integer | no | The duration, in seconds, that the session should last. Acceptable durations for federation sessions range from 900 seconds (15 minutes)… |
| Tags | array | no | A list of session tags. Each session tag consists of a key name and an associated value. For more information about session tags, see… |

### Returns a set of temporary credentials for an Amazon Web Services account or IAM user. The credentials…
`GET https://zieapi.vercel.app/v1/cloud:amazonaws-sts/get-get-session-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| DurationSeconds | integer | no | The duration, in seconds, that the credentials should remain valid. Acceptable durations for IAM user sessions range from 900 seconds (15… |
| SerialNumber | string | no | The identification number of the MFA device that is associated with the IAM user who is making the GetSessionToken call. Specify this… |
| TokenCode | string | no | The value provided by the MFA device, if MFA is required. If any policy requires the IAM user to submit an MFA code, specify this value.… |

## Example
```
curl "https://zieapi.vercel.app/v1/cloud:amazonaws-sts/get-assume-role" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the AWS Security Token Service API?
Create a free Apizie key, then send GET https://zieapi.vercel.app/v1/cloud:amazonaws-sts/get-assume-role with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the AWS Security Token Service API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. AWS Security Token Service itself also needs your own key from amazonaws.com.

### Can AI agents use the AWS Security Token Service API?
Yes. Add the Apizie MCP server (https://zieapi.vercel.app/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:amazonaws-sts.

### What is the status of the AWS Security Token Service API?
Needs your own provider key (bring your own key)