# Alibaba Cloud Cloud SSO API

> Alibaba Cloud Cloud SSO API on Apizie: 88 endpoints (Adds a Security Assertion Markup Language (SAML) signing certificate, Adds a policy to an access configuration, Adds a user to a group, Clears the configurations of a Security Assertion Markup Language (SAML) identity provider (IdP), …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://apizie.tech/v1/cloud:aliyun-cloudsso/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:aliyun-cloudsso`
- Category: Cloud
- Status: byok
- Source: https://api.alibabacloud.com/product/cloudsso
- Page: https://apizie.tech/api/cloud/aliyun-cloudsso
- OpenAPI: https://apizie.tech/api/cloud/aliyun-cloudsso/openapi.json

Alibaba Cloud OpenAPI for Cloud SSO (cloudsso, version 2021-05-15). Calls are signed with ACS3-HMAC-SHA256 using your AccessKey ID and secret.

## Endpoints

### Adds a Security Assertion Markup Language (SAML) signing certificate
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/add-external-samlid-pcertificate` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| X509Certificate | string | no | The X.509 certificate in the PEM format. The certificate is provided by the SAML identity provider (IdP) |

### Adds a policy to an access configuration
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/add-permission-policy-to-access-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| AccessConfigurationId | string | no | The ID of the access configuration |
| PermissionPolicyType | string | no | The type of the policy. Valid values: System: system policy. Resource Access Management (RAM) system policies are reused. Inline: inline… |
| PermissionPolicyName | string | no | The name of the policy. If you set `PermissionPolicyType` to `System`, you must set PermissionPolicyName to the name of a system policy.… |
| InlinePolicyDocument | string | no | The configurations of the inline policy. The value can be up to 4,096 characters in length. If you set `PermissionPolicyType` to `Inline`,… |

### Adds a user to a group
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/add-user-to-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| GroupId | string | no | The ID of the group |
| UserId | string | no | The ID of the user |
| DirectoryId | string | no | The ID of the directory |

### Clears the configurations of a Security Assertion Markup Language (SAML) identity provider (IdP)
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/clear-external-samlidentity-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Configures the settings for the users or groups allowed to access an account in a resource directory, and…
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/create-access-assignment` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| AccessConfigurationId | string | no | The access configuration ID |
| TargetType | string | no | The target type of the task. Valid value: RD-Account, which indicates that the task target is an account in a resource directory |
| TargetId | string | no | The ID of the deployment target |
| PrincipalType | string | no | The CloudSSO identity type. Valid values: User: user Group: group |
| PrincipalId | string | no | The CloudSSO identity ID. Details: If PrincipalType is set to User, PrincipalId is the CloudSSO user ID. If PrincipalType is set to Group,… |
| OriginTargetId | string | no | The Alibaba Cloud account ID of the authorization target |

### Creates an access configuration
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/create-access-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| AccessConfigurationName | string | no | The name of the access configuration. Format: contains letters, digits, or hyphens (-). Length: up to 32 characters |
| Description | string | no | The description of the access configuration. Length: up to 1024 characters |
| SessionDuration | integer | no | The session duration. The maximum duration of a session when a CloudSSO user uses the access configuration to access an account in a… |
| RelayState | string | no | The initial access page. The page address that a CloudSSO user initially accesses when using the access configuration to access an account… |
| Tags | string | no | The list of tags (JSON-encoded) |

### Creates a directory
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/create-directory` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryName | string | no | The name of the directory. The name must be globally unique. The name can contain lowercase letters, digits, and hyphens (-). The name… |

### Creates a group
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/create-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| GroupName | string | no | The name of the group. The name can contain letters, digits, underscores (_), hyphens (-), and periods (.).\`\` The name can be up to 128… |
| Description | string | no | The description of the group. The description can be up to 1,024 characters in length |

### Creates a System for Cross-domain Identity Management (SCIM) credential
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/create-scimserver-credential` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Creates a user by calling CreateUser
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/create-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| UserName | string | no | The username. The username must be unique within the directory and cannot be modified. Format: Can contain digits, letters, and the… |
| FirstName | string | no | The first name of the user. Maximum length: 64 characters |
| LastName | string | no | The last name of the user. Maximum length: 64 characters |
| DisplayName | string | no | The display name of the user. Maximum length: 256 characters |
| Description | string | no | The description of the user. Maximum length: 1024 characters |
| Email | string | no | The email address of the user. The email address must be unique within the directory. Maximum length: 128 characters |
| Status | string | no | The status of the user. Valid values: Enabled (default): Enabled. Disabled: Disabled |
| Tags | string | no | The list of tags (JSON-encoded) |

### Creates a Resource Access Management (RAM) user provisioning
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/create-user-provisioning` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the resource directory |
| DuplicationStrategy | string | no | The conflict handling policy. The policy is used when a RAM user has the same username as the CloudSSO user who is synchronized to RAM.… |
| DeletionStrategy | string | no | The deletion policy. The policy is used to manage synchronized users when you delete the RAM user provisioning. Valid values: Delete: When… |
| Description | string | no | The description |
| PrincipalId | string | no | The identity ID of the RAM user provisioning. Valid values: If you set the `PrincipalType` parameter to `Group`, the value of this… |
| PrincipalType | string | no | The identity type of the RAM user provisioning. Valid values: User: The identity of the RAM user provisioning is a CloudSSO user. Group:… |
| TargetId | string | no | The ID of the object for which you create the RAM user provisioning. The value is fixed as the ID of the member in the resource directory |
| TargetType | string | no | The object for which you create the RAM user provisioning. The value is fixed as `RD-Account` |

### Removes the authorization from an account in a resource directory
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/delete-access-assignment` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| AccessConfigurationId | string | no | The access configuration ID |
| TargetType | string | no | The target type of the task. Valid values: RD-Account: The task target is an account in a resource directory |
| TargetId | string | no | The target ID of the task |
| PrincipalType | string | no | The CloudSSO identity type. Valid values: User: user Group: group |
| PrincipalId | string | no | The CloudSSO identity ID. The value varies based on the principal type: If `PrincipalType` is `User`, `PrincipalId` is the CloudSSO user… |
| DeprovisionStrategy | string | no | Specifies whether to remove the access configuration deployment when you remove the last authorization that uses the access configuration… |
| OriginTargetId | string | no | The Alibaba Cloud account ID of the authorization target |

### Deletes an access configuration
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/delete-access-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| AccessConfigurationId | string | no | The ID of the access configuration |
| DirectoryId | string | no | The ID of the directory |
| ForceRemovePermissionPolicies | string | no | Specifies whether to forcibly remove system policies and inline policies. Valid values: true: When you delete the access configuration,… |

### Deletes a directory
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/delete-directory` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Deletes a group
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/delete-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| GroupId | string | no | The ID of the group |

### Deletes the MFA device of a user
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/delete-mfadevice-for-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| UserId | string | no | The user ID |
| MFADeviceId | string | no | The MFA device ID. You can call https://help.aliyun.com/document_detail/333531.html to query the MFA device ID |
| DirectoryId | string | no | The directory ID |
| MfaType | string | no | The MfaType |

### Deletes a System for Cross-domain Identity Management (SCIM) credential
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/delete-scimserver-credential` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| CredentialId | string | no | The ID of the SCIM credential |

### Deletes a user
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/delete-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| UserId | string | no | The ID of the user |

### Deletes a Resource Access Management (RAM) user provisioning
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/delete-user-provisioning` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the resource directory |
| UserProvisioningId | string | no | The ID of the RAM user provisioning |
| DeletionStrategy | string | no | The deletion policy. The policy is used to manage synchronized users when you delete the RAM user provisioning. Valid values: Delete: When… |

### Deletes a Resource Access Management (RAM) user provisioning event
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/delete-user-provisioning-event` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| EventId | string | no | The ID of the RAM user provisioning event. You can call the https://help.aliyun.com/document_detail/2636305.html operation to query the… |
| DirectoryId | string | no | The ID of the resource directory |
| UserProvisioningId | string | no | The ID of the RAM user provisioning |

### Deprovisions an access configuration from an account in a resource directory
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/deprovision-access-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| AccessConfigurationId | string | no | The ID of the access configuration |
| TargetType | string | no | The type of the task target. Valid values: RD-Account: The task target is an account in a resource directory |
| TargetId | string | no | The ID of the task target |
| OriginTargetId | string | no | The ID of the Alibaba Cloud account to which the deployment target belongs |

### Disables the delegated administrator account of CloudSSO
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/disable-delegate-account` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| AccountId | string | no | The ID of the delegated administrator account of CloudSSO |

### Disables CloudSSO
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/disable-service` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |

### Enables the delegated administrator account of CloudSSO
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/enable-delegate-account` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| AccountId | string | no | The ID of the delegated administrator account of CloudSSO |

### Enables CloudSSO
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/enable-service` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |

### Queries the information about an access configuration
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-access-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| AccessConfigurationId | string | no | The access configuration ID |
| DirectoryId | string | no | The directory ID |

### Queries the attribute passing settings of a specified directory to retrieve the current configuration of the…
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-attribute-passing-setting` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |

### Queries information about a directory
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-directory` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Queries information about a Security Assertion Markup Language (SAML) service provider (SP)
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-directory-samlservice-provider-info` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Queries the statistics of a directory
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-directory-statistics` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Queries the configurations of a Security Assertion Markup Language (SAML) identity provider (IdP)
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-external-samlidentity-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Queries information about a group
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| GroupId | string | no | The ID of the group |
| DirectoryId | string | no | The ID of the directory |

### Queries the logon preference of CloudSSO users
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-login-preference` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Queries the global multi-factor authentication (MFA) configuration
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-mfaauthentication-setting-info` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |

### Queries the multi-factor authentication (MFA) setting of all users
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-mfaauthentication-settings` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Checks whether multi-factor authentication (MFA) is enabled for users
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-mfaauthentication-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Queries the password policy of CloudSSO users
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-password-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Queries the status of System for Cross-domain Identity Management (SCIM) synchronization
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-scimsynchronization-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Queries the status of CloudSSO
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-service-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |

### Queries the details of an asynchronous task
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-task` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| TaskId | string | no | The task ID |

### Queries the status of an asynchronous task
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-task-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| TaskId | string | no | The task ID |

### Queries the information about a specified user
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| UserId | string | no | The user ID |
| DirectoryId | string | no | The directory ID |

### Queries the ID of a user in a resource directory by using the ExternalId parameter
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-user-id` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the resource directory |
| ExternalId | string | no | The identifier information about the user that is synchronized from an external identity provider (IdP) (JSON-encoded) |

### Queries the multi-factor authentication (MFA) setting of a single user
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-user-mfaauthentication-settings` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| UserId | string | no | The ID of the user |
| DirectoryId | string | no | The ID of the directory |

### Queries a Resource Access Management (RAM) user provisioning
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-user-provisioning` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the resource directory |
| UserProvisioningId | string | no | The ID of the RAM user provisioning |

### Queries the global configurations of a Resource Access Management (RAM) user provisioning
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-user-provisioning-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the resource directory |

### Queries the information about a Resource Access Management (RAM) user provisioning
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-user-provisioning-event` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| EventId | string | no | The ID of the RAM user provisioning event. You can call the https://help.aliyun.com/document_detail/2636305.html operation to query the… |
| DirectoryId | string | no | The ID of the resource directory |

### Queries statistics of Resource Access Management (RAM) user provisioning events that are created for the…
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-user-provisioning-rd-account-statistics` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the resource directory |
| RdMemberId | string | no | The ID of the member in the resource directory |

### Queries the statistics of a Resource Access Management (RAM) user provisioning
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/get-user-provisioning-statistics` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the resource directory |
| UserProvisioningId | string | no | The ID of the RAM user provisioning |

### Queries access assignments
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-access-assignments` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| AccessConfigurationId | string | no | The ID of the access configuration. This parameter is used as a filter condition for the query |
| TargetType | string | no | The type of the task target, which is used as a filter condition for the query. Valid values: RD-Account: The task target is an account in… |
| TargetId | string | no | The ID of the task target, which is used as a filter condition for the query. You must specify both `TargetId` and `TargetType` for the… |
| PrincipalType | string | no | The type of the CloudSSO identity, which is used as a filter condition for the query. Valid values: User: user. Group: group. You must… |
| PrincipalId | string | no | The ID of the CloudSSO identity, which is used as a filter condition for the query. Details: If `PrincipalType` is set to User,… |
| NextToken | string | no | The token for the next page of query results. You do not need to specify `NextToken` when you call this operation for the first time. When… |
| MaxResults | integer | no | The maximum number of entries to return on each page. Valid values: 1 to 20. Default value: 10 |
| OriginTargetId | string | no | The ID of the Alibaba Cloud account to which the authorization target belongs |

### Queries access configuration provisionings
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-access-configuration-provisionings` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| AccessConfigurationId | string | no | The access configuration ID used as a filter condition for the query |
| TargetType | string | no | The target type used as a filter condition for the query. Valid values: RD-Account: The target is an account in a resource directory. You… |
| TargetId | string | no | The target ID used as a filter condition for the query. You must specify both TargetId and TargetType for them to take effect as filter… |
| ProvisioningStatus | string | no | The provisioning status used as a filter condition for the query. Valid values: Provisioned: The provisioning succeeded.… |
| NextToken | string | no | The token used to return the next page of query results. You do not need to specify NextToken when you call this operation for the first… |
| MaxResults | integer | no | The maximum number of entries to return on each page. Valid values: 1 to 20. Default value: 10 |
| OriginTargetId | string | no | The Alibaba Cloud account ID of the provisioning target |

### Queries the list of access configurations
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-access-configurations` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| NextToken | string | no | The token for the next page of results. You do not need to specify `NextToken` for the first API call. When you call this API operation… |
| MaxResults | integer | no | The maximum number of entries per page. Valid values: 1 to 100. Default value: 10 |
| Filter | string | no | The filter condition. Format: . The filter is case-insensitive. Currently, supports only AccessConfigurationName, and supports only eq… |
| StatusNotifications | string | no | The status notification information, which is used as a filter condition for the query. Valid values: ReprovisionRequired, which queries… |
| Tags | string | no | The list of tags (JSON-encoded) |

### Queries directories
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-directories` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |

### Queries Security Assertion Markup Language (SAML) signing certificates
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-external-samlid-pcertificates` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Queries the users in a group
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-group-members` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| GroupId | string | no | The ID of the group |
| DirectoryId | string | no | The ID of the directory |
| NextToken | string | no | The pagination token that is used in the next request to retrieve a new page of results. You do not need to specify this parameter for the… |
| MaxResults | integer | no | The number of entries per page. Valid values: 1 to 100. Default value: 10 |

### Queries groups
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-groups` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| NextToken | string | no | The pagination token that is used in the next request to retrieve a new page of results. You do not need to specify this parameter for the… |
| MaxResults | integer | no | The number of entries per page. Valid values: 1 to 100. Default value: 10 |
| Filter | string | no | The filter condition. You must specify the value in the ` ` format. The value is not case-sensitive. You can set ` ` only to `GroupName`… |
| ProvisionType | string | no | The type of the group. The type can be used to filter groups. Valid values: Manual: The group is manually created. Synchronized: The group… |

### Queries the groups to which a user is added
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-joined-groups-for-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| UserId | string | no | The ID of the user |
| DirectoryId | string | no | The ID of the directory |
| NextToken | string | no | The pagination token that is used in the next request to retrieve a new page of results. You do not need to specify this parameter for the… |
| MaxResults | integer | no | The number of entries per page. Valid values: 1 to 100. Default value: 10 |

### Queries the MFA device list of a user. Each user can have a maximum of two MFA devices
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-mfadevices-for-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| UserId | string | no | The user ID |

### Queries the policies that are created for an access configuration
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-permission-policies-in-access-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| AccessConfigurationId | string | no | The ID of the access configuration |
| PermissionPolicyType | string | no | The type of the policy. The type can be used to filter policies. Valid values: System: system policy. Inline: inline policy. If you do not… |

### Queries Cross-domain Identity Management (SCIM) credentials
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-scimserver-credentials` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |

### Queries a list of asynchronous tasks
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-tasks` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| AccessConfigurationId | string | no | The ID of the access configuration. This parameter is used as a filter condition for the query |
| TargetType | string | no | The type of the task target. This parameter is used as a filter condition for the query. Valid values: RD-Account: The task target is an… |
| TargetId | string | no | The ID of the task target. This parameter is used as a filter condition for the query. TargetId and TargetType must be specified at the… |
| PrincipalType | string | no | The type of the CloudSSO identity. This parameter is used as a filter condition for the query. Valid values: User: The CloudSSO user.… |
| PrincipalId | string | no | The ID of the CloudSSO identity. This parameter is used as a filter condition for the query. Details: If PrincipalType is set to User,… |
| TaskType | string | no | The type of the node. This parameter is used as a filter condition for the query. Valid values: ProvisionAccessConfiguration: Access… |
| Status | string | no | The status of the task. This parameter is used as a filter condition for the query. Valid values: InProgress: The task is running.… |
| NextToken | string | no | The token used to return the next page of the query results. You do not need to specify NextToken when you call this operation for the… |
| MaxResults | integer | no | The maximum number of entries to return on each page. Valid values: 1 to 20. Default value: 10 |
| Filter | string | no | The filter condition. Format: . The format is not case-sensitive. only supports StartTime. only supports ge (greater than or equal to).… |

### Queries Resource Access Management (RAM) user provisioning events
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-user-provisioning-events` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| UserProvisioningId | string | no | The ID of the RAM user provisioning |
| DirectoryId | string | no | The ID of the resource directory |
| MaxResults | integer | no | The maximum number of entries per page. Valid values: 1 to 100. Default value: 10 |
| NextToken | string | no | The token that is used to initiate the next request. If this is your first time to call this operation, you do not need to specify the… |

### Queries Resource Access Management (RAM) user provisionings
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-user-provisionings` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the resource directory |
| PrincipalId | string | no | The identity ID of the RAM user provisioning. Valid values: If `Group` is returned for the `PrincipalType` parameter, the value of this… |
| PrincipalType | string | no | The identity type of the RAM user provisioning. Valid values: User: The identity of the RAM user provisioning is a CloudSSO user. Group:… |
| TargetId | string | no | The ID of the object for which you create the RAM user provisioning. The value is fixed as the ID of the member in the resource directory |
| TargetType | string | no | The object for which you create the RAM user provisioning. The value is fixed as `RD-Account` |
| MaxResults | integer | no | The maximum number of entries per page. Valid values: 1 to 100. Default value: 10 |
| NextToken | string | no | The token that is used to initiate the next request. If this is your first time to call this operation, you do not need to specify the… |

### Queries a list of users
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/list-users` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| Status | string | no | The user status. This parameter is used as a filter condition. Valid values: Enabled: The user is enabled. Disabled: The user is disabled |
| ProvisionType | string | no | The user type. This parameter is used as a filter condition. Valid values: Manual: The user is manually created. Synchronized: The user is… |
| Filter | string | no | The filter condition. Format: ` `. This value is case-insensitive. Currently, ` ` supports only `UserName`, and `Operator` supports only… |
| MaxResults | integer | no | The maximum number of entries per page. Valid values: 1 to 100. Default value: 10 |
| NextToken | string | no | The token for the next page of results. You do not need to specify `NextToken` for the first API call. When you call the API for the first… |
| Tags | string | no | The tag list (JSON-encoded) |

### Invokes ProvisionAccessConfiguration to perform access configuration provisioning and deployment for an…
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/provision-access-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| AccessConfigurationId | string | no | The access configuration ID |
| TargetType | string | no | The target type of the task. Valid values: RD-Account: The task target is an account in a resource directory |
| TargetId | string | no | The ID of the task target |
| OriginTargetId | string | no | The ID of the Alibaba Cloud account to which the deployment target belongs |

### Removes a Security Assertion Markup Language (SAML) signing certificate
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/remove-external-samlid-pcertificate` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| CertificateId | string | no | The ID of the certificate. You can call the https://help.aliyun.com/document_detail/341629.html operation to query the IDs of certificates |

### Removes a policy from an access configuration
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/remove-permission-policy-from-access-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| AccessConfigurationId | string | no | The ID of the access configuration |
| PermissionPolicyType | string | no | The type of the policy. Valid values: System: system policy. Inline: inline policy |
| PermissionPolicyName | string | no | The name of the policy |

### Removes a user from a group
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/remove-user-from-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| GroupId | string | no | The ID of the group |
| UserId | string | no | The ID of the user |
| DirectoryId | string | no | The ID of the directory |

### Resets the password of a user
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/reset-user-password` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| UserId | string | no | The ID of the user |
| Password | string | no | The new password. The password must contain the following types of characters: uppercase letters, lowercase letters, digits, and special… |
| GenerateRandomPassword | string | no | Specifies whether to enable the system to automatically generate a new password. Valid values: True: The new password is automatically… |
| RequirePasswordResetForNextLogin | string | no | Specifies whether password reset is required upon the next logon. Valid values: True: Password reset is required upon the next logon.… |

### Retries a Resource Access Management (RAM) user provisioning event
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/retry-user-provisioning-event` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| EventId | string | no | The ID of the RAM user provisioning event. You can call the https://help.aliyun.com/document_detail/2636305.html operation to query the… |
| DirectoryId | string | no | The ID of the resource directory |
| DuplicationStrategy | string | no | The conflict handling policy. The policy is used when a RAM user has the same username as the CloudSSO user who is synchronized to RAM.… |

### Configures a Security Assertion Markup Language (SAML) identity provider (IdP)
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/set-external-samlidentity-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| EncodedMetadataDocument | string | no | The metadata file of the IdP. The value of this parameter is Base64-encoded. The file is provided by the IdP that supports SAML 2.0 |
| SSOStatus | string | no | The status of SSO logon. Valid values: Enabled Disabled (default) |
| EntityId | string | no | The entity ID of the IdP |
| LoginUrl | string | no | The logon URL of the IdP |
| WantRequestSigned | string | no | Specifies whether CloudSSO needs to sign SAML requests. The requests are sent when users log on to the CloudSSO user portal to initiate… |
| X509Certificate | string | no | The X.509 certificate in the PEM format. If you specify this parameter, all existing certificates are replaced |
| BindingType | string | no | The binding for sending SAML requests. Valid values: Post: HTTP Post bindings. Redirect: HTTP Redirect bindings |

### Configures the logon preference of CloudSSO users
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/set-login-preference` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| LoginNetworkMasks | string | no | The IP address whitelist. CloudSSO users can log on to the CloudSSO user portal only by using the IP addresses in the whitelist. Limits:… |
| AllowUserToGetCredentials | string | no | Specifies whether to allow a user to obtain the application access credential after logon to the portal. Valid values: True False (default) |

### Enables or disables multi-factor authentication (MFA) for users in a directory
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/set-mfaauthentication-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| MFAAuthenticationStatus | string | no | The status of MFA. Valid values: Enabled Disabled |

### Configures a password policy for CloudSSO users
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/set-password-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| MinPasswordLength | integer | no | The minimum password length. Valid values: 8 to 32 characters |
| MinPasswordDifferentChars | integer | no | The minimum number of unique characters in a password. The minimum value is 0, which specifies that the minimum number of unique… |
| PasswordNotContainUsername | string | no | Specifies whether a password can contain the username. Valid value: true: A password cannot contain the username. false: A password can… |
| MaxPasswordAge | integer | no | The validity period of a password. Valid values: 1 to 120. Unit: days |
| PasswordReusePrevention | integer | no | The policy for password history check. The previous N passwords cannot be reused. Valid values of N: 0 to 24. The value 0 specifies that… |
| MaxLoginAttempts | integer | no | The number of password retries. If you enter wrong passwords for the specified consecutive times, the account is locked for 1 hour. Valid… |

### Enables or disables System for Cross-domain Identity Management (SCIM) synchronization
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/set-scimsynchronization-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| SCIMSynchronizationStatus | string | no | The status of SCIM synchronization. Valid values: Enabled Disabled |

### Modifies information about an access configuration
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/update-access-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| AccessConfigurationId | string | no | The ID of the access configuration |
| NewDescription | string | no | The new description of the access configuration. The description can be up to 1,024 characters in length |
| NewSessionDuration | integer | no | The new duration of a session in which a CloudSSO user accesses an account in your resource directory by using the access configuration.… |
| NewRelayState | string | no | The new initial web page that is displayed after a CloudSSO user accesses an account in your resource directory by using the access… |

### Updates the attribute passing settings for a specified directory, allowing you to set the SourceIdentity…
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/update-attribute-passing-setting` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| SourceIdentityPassing | string | no | The SourceIdentity pass-through mode. Three pass-through modes are supported. If this parameter is not specified, the existing… |

### Changes the name of a directory
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/update-directory` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| NewDirectoryName | string | no | The new name of the directory. The name must be globally unique. The name can contain lowercase letters, digits, and hyphens (-). The name… |

### Modifies the information about a group
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/update-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| GroupId | string | no | The ID of the group |
| NewGroupName | string | no | The new name of the group |
| NewDescription | string | no | The new description of the group |

### Modifies an inline policy that is created for an access configuration
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/update-inline-policy-for-access-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| AccessConfigurationId | string | no | The ID of the access configuration |
| InlinePolicyName | string | no | The name of the inline policy |
| NewInlinePolicyDocument | string | no | The new configurations of the inline policy. The value can be up to 4,096 characters in length. For more information about the syntax and… |

### Modifies the global multi-factor authentication (MFA) settings
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/update-mfaauthentication-settings` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The directory ID |
| MFAAuthenticationSettings | string | no | The global MFA settings. Valid values: Enabled: MFA verification is enabled for all users. Byuser: MFA verification depends on the… |
| OperationForRiskLogin | string | no | The action to take when the MFA settings option is set to verify only for unusual logon attempts. Valid values: Autonomous: Users can skip… |
| AllowedVerificationTypes | string | no | The AllowedVerificationTypes (JSON-encoded) |

### Enables or disables a System for Cross-domain Identity Management (SCIM) credential
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/update-scimserver-credential-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| CredentialId | string | no | The ID of the SCIM credential |
| NewStatus | string | no | The new status of the SCIM credential. Valid values: Enabled: The SCIM credential is enabled. Disabled: The SCIM credential is disabled |

### Modifies information about a user
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/update-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| UserId | string | no | The ID of the user |
| NewFirstName | string | no | The new first name of the user |
| NewLastName | string | no | The new last name of the user |
| NewDisplayName | string | no | The new display name of the user |
| NewDescription | string | no | The new description of the user |
| NewEmail | string | no | The new email address of the user |

### Modifies the multi-factor authentication (MFA) setting of a single user
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/update-user-mfaauthentication-settings` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| UserId | string | no | The ID of the user |
| UserMFAAuthenticationSettings | string | no | Specifies whether to enable MFA for the user. Valid values: Enabled: enables MFA for the user. Disabled: disables MFA for the user |
| DirectoryId | string | no | The ID of the directory |

### Modifies a Resource Access Management (RAM) user provisioning
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/update-user-provisioning` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the resource directory |
| UserProvisioningId | string | no | The ID of the RAM user provisioning |
| NewDuplicationStrategy | string | no | The new conflict handling policy. The policy is used when a RAM user has the same username as the CloudSSO user who is synchronized to… |
| NewDeletionStrategy | string | no | The new deletion policy. The policy is used to manage synchronized users when you delete the RAM user provisioning. Valid values: Delete:… |
| NewDescription | string | no | The new description of the RAM user provisioning |

### Modifies the global configurations of a Resource Access Management (RAM) user provisioning
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/update-user-provisioning-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the resource directory |
| NewDefaultLandingPage | string | no | The new default URL for a CloudSSO user who logs on to the Alibaba Cloud Management Console. Default value:… |
| NewSessionDuration | integer | no | The new duration of the logon session. Unit: hours. Valid values: 1 to 24. Default value: 6 |

### Changes the status of a user
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/update-user-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |
| DirectoryId | string | no | The ID of the directory |
| UserId | string | no | The ID of the user |
| NewStatus | string | no | The new status of the user. Valid values: Enabled: The logon of the user is enabled. Disabled: The logon of the user is disabled |

### version
`POST https://apizie.tech/v1/cloud:aliyun-cloudsso/version` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://cloudsso.ap-southeast-1.aliyuncs.com |

## Example
```
curl "https://apizie.tech/v1/cloud:aliyun-cloudsso/add-external-samlid-pcertificate" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Alibaba Cloud Cloud SSO API?
Create a free Apizie key, then send POST https://apizie.tech/v1/cloud:aliyun-cloudsso/add-external-samlid-pcertificate with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Alibaba Cloud Cloud SSO API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Alibaba Cloud Cloud SSO itself also needs your own key from aliyuncs.com.

### Can AI agents use the Alibaba Cloud Cloud SSO API?
Yes. Add the Apizie MCP server (https://apizie.tech/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:aliyun-cloudsso.

### What is the status of the Alibaba Cloud Cloud SSO API?
Needs your own provider key (bring your own key)