# Alibaba Cloud Identity as a service API

> Alibaba Cloud Identity as a service API on Apizie: 358 endpoints (Adds an application account for a specified employee under the current application, Adds an application to an authorization rule, Adds terms to a brand, Adds a group to an authorization rule, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://apizie.tech/v1/cloud:aliyun-eiam/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:aliyun-eiam`
- Category: Cloud
- Status: byok
- Source: https://api.alibabacloud.com/product/eiam
- Page: https://apizie.tech/api/cloud/aliyun-eiam
- OpenAPI: https://apizie.tech/api/cloud/aliyun-eiam/openapi.json

Alibaba Cloud OpenAPI for Identity as a service (eiam, version 2021-12-01). Calls are signed with ACS3-HMAC-SHA256 using your AccessKey ID and secret.

## Endpoints

### Adds an application account for a specified employee under the current application
`POST https://apizie.tech/v1/cloud:aliyun-eiam/add-application-account-to-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| UserId | string | yes | The user ID |
| ApplicationUsername | string | yes | The application account name |

### Adds an application to an authorization rule
`POST https://apizie.tech/v1/cloud:aliyun-eiam/add-application-to-authorization-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| AuthorizationRuleId | string | yes | The authorization rule ID |
| ApplicationId | string | yes | The application ID |
| ValidityType | string | yes | The validity period type. Valid values: permanent: The authorization is permanent. time_bound: The authorization is valid for a custom… |
| ValidityPeriod | string | no | The time range of the validity period. This parameter is valid only when you set ValidityType to time_bound (JSON-encoded) |
| ClientToken | string | yes | A client token used to ensure the idempotence of the request. Generate a value from your client to make sure that the value is unique… |

### Adds terms to a brand
`POST https://apizie.tech/v1/cloud:aliyun-eiam/add-custom-privacy-policies-to-brand` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| BrandId | string | yes | The brand ID |
| CustomPrivacyPolicyIds | string | yes | The list of term IDs (JSON-encoded) |

### Adds a group to an authorization rule
`POST https://apizie.tech/v1/cloud:aliyun-eiam/add-group-to-authorization-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| AuthorizationRuleId | string | yes | The authorization rule ID |
| GroupId | string | yes | The group ID |
| ValidityType | string | yes | The validity type of the relationship. Valid values: permanent: permanent time_bound: custom time range |
| ValidityPeriod | string | no | The time range of the validity period. This parameter takes effect only when ValidityType is set to time_bound (JSON-encoded) |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but you must… |

### Adds an account to an authorization rule
`POST https://apizie.tech/v1/cloud:aliyun-eiam/add-user-to-authorization-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| AuthorizationRuleId | string | yes | The authorization rule ID |
| UserId | string | yes | The account ID |
| ValidityType | string | yes | The validity type of the relationship. Valid values: permanent: permanent time_bound: custom time range |
| ValidityPeriod | string | no | The time range of the validity period. This parameter takes effect only when ValidityType is set to time_bound (JSON-encoded) |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but make… |

### Adds a specified EIAM account to multiple EIAM organizations. If the account already exists in an…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/add-user-to-organizational-units` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| UserId | string | yes | The account ID |
| OrganizationalUnitIds | string | yes | The list of organization IDs. The list can contain up to 100 elements (JSON-encoded) |

### Adds multiple Employee Identity and Access Management (EIAM) accounts to a specified EIAM account group
`POST https://apizie.tech/v1/cloud:aliyun-eiam/add-users-to-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| GroupId | string | yes | The group ID |
| UserIds | string | yes | The list of account IDs. The list can contain up to 100 elements (JSON-encoded) |

### Grants multiple EIAM groups access to an application in a batch
`POST https://apizie.tech/v1/cloud:aliyun-eiam/authorize-application-to-groups` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| GroupIds | string | yes | The list of group IDs. You can specify up to 100 group IDs in a single request (JSON-encoded) |
| ApplicationRoleId | string | no | The application role ID |

### Grants access to an application for multiple EIAM organizations in a batch operation
`POST https://apizie.tech/v1/cloud:aliyun-eiam/authorize-application-to-organizational-units` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| OrganizationalUnitIds | string | yes | The list of organization IDs. You can specify a maximum of 100 organization IDs per operation (JSON-encoded) |
| ApplicationRoleId | string | no | 应用角色ID |

### Grants multiple EIAM accounts access to an application in a batch
`POST https://apizie.tech/v1/cloud:aliyun-eiam/authorize-application-to-users` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| UserIds | string | yes | The list of account IDs. You can specify up to 100 account IDs in a single request (JSON-encoded) |
| ApplicationRoleId | string | no | The application role ID |

### Grants Scope permissions under a specified ResourceServer to a Client application
`POST https://apizie.tech/v1/cloud:aliyun-eiam/authorize-resource-server-scopes-to-client` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ClientApplicationId | string | yes | The unique identifier of the Client application |
| ResourceServerApplicationId | string | yes | The unique identifier of the ResourceServer application |
| ResourceServerScopeIds | string | yes | The list of Scope permission IDs under the ResourceServer (JSON-encoded) |

### Grants Scope permissions under a specified ResourceServer to a group
`POST https://apizie.tech/v1/cloud:aliyun-eiam/authorize-resource-server-scopes-to-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| GroupId | string | yes | The group ID |
| ApplicationId | string | yes | The application ID of the ResourceServer |
| ResourceServerScopeIds | string | yes | The list of Scope permission IDs under the ResourceServer (JSON-encoded) |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but you must… |

### Grants scope permissions under a specified ResourceServer to an organizational unit
`POST https://apizie.tech/v1/cloud:aliyun-eiam/authorize-resource-server-scopes-to-organizational-unit` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| OrganizationalUnitId | string | yes | The organizational unit ID |
| ApplicationId | string | yes | The application ID of the ResourceServer |
| ResourceServerScopeIds | string | yes | The list of scope permission IDs under the ResourceServer (JSON-encoded) |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but you must… |

### Grants Scope permissions under a specified ResourceServer to an account
`POST https://apizie.tech/v1/cloud:aliyun-eiam/authorize-resource-server-scopes-to-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| UserId | string | yes | The account ID |
| ApplicationId | string | yes | The application ID of the ResourceServer |
| ResourceServerScopeIds | string | yes | The list of Scope permission IDs under the ResourceServer (JSON-encoded) |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but you must… |

### Grants a specified ResourceServer to a Client application
`POST https://apizie.tech/v1/cloud:aliyun-eiam/authorize-resource-server-to-client` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ClientApplicationId | string | yes | The unique identifier of the Client application |
| ResourceServerApplicationId | string | yes | The ID of the ResourceServer application |

### Associates a third-party logon account
`POST https://apizie.tech/v1/cloud:aliyun-eiam/bind-user-authn-source-mapping` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| UserId | string | yes | The user ID |
| IdentityProviderId | string | yes | The source IdP ID |
| UserExternalId | string | yes | The external association ID |

### Checks whether the primary organization for application synchronization is within the application…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/check-application-provisioning-user-primary-organizational-u` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| UserPrimaryOrganizationalUnitId | string | yes | The organization ID |

### Checks whether an instance can be deleted
`POST https://apizie.tech/v1/cloud:aliyun-eiam/check-instance-for-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |

### Checks whether an instance has the feature of a specific module
`POST https://apizie.tech/v1/cloud:aliyun-eiam/check-instance-module-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ModuleKey | string | yes | The level-1 module identifier |
| FeatureKey | string | no | The level-2 module identifier |
| SubFeatureKey | string | no | The level-3 module identifier |
| ResourceLabelKey | string | no | The resource label URN key |
| ResourceLabelValue | string | no | The resource label name |

### Creates an application resource in a specified Employee Identity and Access Management (EIAM) instance
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationName | string | yes | The application name |
| Description | string | no | The application description |
| LogoUrl | string | no | The URL of the application logo |
| ApplicationSourceType | string | yes | The source from which the application is created. Valid values: urn:alibaba:idaas:app:source:template: application template.… |
| SsoType | string | yes | The single sign-on (SSO) protocol. Valid values: saml2: SAML 2.0 protocol. oidc: OpenID Connect protocol |
| ApplicationTemplateId | string | no | The application template ID. This parameter is required when the ApplicationSourceType parameter is set to… |
| ApplicationIdentityType | string | no | The application identity type. Default value: application. Valid values: application: application. agent: agent |
| CustomFields | string | no | The list of application extension fields (JSON-encoded) |
| ApplicationOwner | string | no | The application owner (JSON-encoded) |

### Creates a client secret for an EIAM application. You can create a maximum of two client secrets for each…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-application-client-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ExpirationTime | integer | no | The expiration time in UNIX timestamp format, in milliseconds. If this parameter is left empty, the client secret is permanently valid.… |

### Creates an application federated credential
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-application-federated-credential` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| FederatedCredentialProviderId | string | yes | The federated credential provider ID |
| ApplicationFederatedCredentialType | string | yes | The application federated credential type |
| ApplicationFederatedCredentialName | string | yes | The application federated credential name |
| VerificationCondition | string | no | The verification condition |
| Description | string | no | The description |
| AttributeMappings | string | no | The attribute mappings (JSON-encoded) |
| VerificationMode | string | no | The verification mode. Valid values: freedom: free mode structured: structured mode |
| OidcVerificationConfig | string | no | The OIDC structured configuration (JSON-encoded) |
| Pkcs7VerificationConfig | string | no | The PKCS#7 structured configuration (JSON-encoded) |

### Creates an application role
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-application-role` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ApplicationRoleName | string | yes | The application role name |
| ApplicationRoleValue | string | yes | The application role value |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but you must… |

### Creates an application token
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-application-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ApplicationTokenType | string | yes | The application token type |
| ExpirationTime | integer | no | The expiration time. Specify a UNIX timestamp in milliseconds |

### Creates an authorization resource
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-authorization-resource` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| AuthorizationRuleId | string | yes | The authorization rule ID |
| AuthorizationResourceEntityType | string | yes | The type of the resource entity associated with the authorization resource. Valid values: cloud_account_role: cloud role |
| AuthorizationResourceEntityId | string | yes | The ID of the resource entity associated with the authorization resource |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but you must… |
| Condition | string | no | The effective condition (JSON-encoded) |

### Creates an authorization rule
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-authorization-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| AuthorizationRuleName | string | yes | The name of the authorization rule. The name can be up to 64 characters in length |
| ProjectId | string | yes | The ID of the project associated with the authorization rule. If you are unsure which project to associate, you can associate the default… |
| AuthorizationResourceScope | string | no | The authorization resource scope. Valid values: global: all resources under the project. custom: specified resources under the project |
| Description | string | no | The description of the authorization rule. The description can be up to 128 characters in length |
| AuthorizationRuleScenarioLabel | string | no | The scenario label of the authorization rule. The label can be up to 64 characters in length |
| ClientToken | string | yes | Ensures the idempotence of the request. Generate a parameter value from your client to ensure that the value is unique across different… |

### Creates a brand
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-brand` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| BrandName | string | yes | The brand name |

### Creates a ClientPublicKey for an application. When an M2M client uses the PRIVATE_KEY_JWT method to request…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-client-public-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| PublicKey | string | yes | The public key in PEM format. The key must be of the SPKI type, starting with "-----BEGIN PUBLIC KEY-----" and ending with "-----END… |
| AlgorithmType | string | yes | The algorithm type |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but make… |

### Creates a cloud account resource under a specified EIAM instance
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-cloud-account` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| CloudAccountName | string | no | The cloud account name |
| CloudAccountVendorType | string | yes | The cloud account type. Valid values: alibaba_cloud: Alibaba Cloud |
| CloudAccountExternalId | string | yes | The external unique identifier of the cloud account |
| CloudAccountProviderName | string | no | The identity provider name |
| Description | string | no | The description of the cloud account |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. Generate a parameter value from your client to ensure that the… |
| CloudAccountSite | string | no | The cloud account site. Valid values: global: International site. china_mainland: China site |

### Creates a cloud role resource under the specified cloud account resource
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-cloud-account-role` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| CloudAccountId | string | yes | The cloud account ID |
| CloudAccountRoleType | string | no | The cloud role type. The specific format depends on the cloud account type. Valid values: role: applicable to Alibaba Cloud accounts |
| CloudAccountRoleName | string | yes | The cloud role name |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but you must… |
| Description | string | no | The cloud role description |

### Creates a conditional access policy
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-conditional-access-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | Instance ID |
| ConditionalAccessPolicyName | string | yes | Conditional access policy name |
| Description | string | no | Conditional access policy description |
| ConditionalAccessPolicyType | string | yes | Conditional access policy type. Valid values: arn:alibaba:idaas:authn:access:policy:system: system policy |
| DecisionType | string | yes | Conditional access policy execution type. Valid values: enforcement: enforcement policy |
| EvaluateAt | string | yes | Conditional access policy evaluation point. Valid values: arn:alibaba:idaas:authn:access:rule:eval_at:after_step1: allow |
| DecisionConfig | string | no | Conditional access policy action configuration (JSON-encoded) |
| ConditionsConfig | string | no | Conditional access policy condition configuration (JSON-encoded) |
| Priority | integer | no | Conditional access policy priority. A smaller value indicates a higher priority. Minimum value: 1. Maximum value: 100 |
| ClientToken | string | no | Idempotency token |

### Creates a credential resource in a specified EIAM instance
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-credential` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| CredentialIdentifier | string | yes | The credential identifier |
| CredentialName | string | yes | The credential name |
| CredentialSubjectType | string | no | The subject type to which the credential belongs. Valid values: authentication_token_provider: authentication token provider |
| CredentialSubjectId | string | no | The subject ID to which the credential belongs |
| CredentialScenarioLabel | string | no | The Scenarios label of the credential. Valid values: llm: large language model. saas: third-party SaaS service |
| CredentialType | string | yes | The credential type. Valid values: api_key: API key authentication credential. oauth_client: OAuth client authentication credential |
| CredentialContent | string | yes | The content of the credential (JSON-encoded) |
| Description | string | no | The description of the credential |
| ClientToken | string | yes | Ensures the idempotence of the request. Generate a parameter value from your client to ensure that the value is unique across different… |
| CredentialSharingScope | string | no | The sharing scope of the credential |
| ExclusiveUserId | string | no | The exclusive user ID of the credential |
| CredentialExternalId | string | no | The external unique identifier of the credential |

### Creates a credential provider
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ClientToken | string | yes | The idempotency token that ensures the idempotence of the request. Generate a unique parameter value from your client to ensure that… |
| CredentialProviderIdentifier | string | yes | The business identifier of the credential provider. Allowed characters include uppercase and lowercase letters, digits, and the special… |
| CredentialProviderName | string | yes | The name of the credential provider. The length cannot exceed 64 characters |
| Description | string | no | The description. The length cannot exceed 128 characters |
| CredentialProviderType | string | yes | The type of the credential provider. Valid values: oauth: OAuth credential provider. jwt: JWT credential provider |
| CredentialProviderConfig | string | no | The configuration of the credential provider (JSON-encoded) |

### Creates an extended field
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-custom-field` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| EntityType | string | yes | The entity to which the field belongs. Valid values: user: account |
| FieldName | string | yes | The field identifier. Maximum length: 40 characters. The value can contain lowercase letters and underscores, and cannot start with an… |
| FieldDisplayName | string | yes | The field display name. Maximum length: 64 characters |
| FieldDisplayType | string | yes | The field display type. Valid values: input: text input box. Supported data types: string and number. select: drop-down list. Supported… |
| FieldDataType | string | yes | The data type of the field. Valid values: string: string. number: number. Maximum length: 32 characters. Positive integers and decimals… |
| DefaultValue | string | no | The default value of the field. If configuration items exist for the type, the default value must be one of the configuration items and… |
| FieldDataConfig | string | no | The field value configuration items (JSON-encoded) |
| Unique | string | no | Specifies whether the field value is unique. If this parameter is set to true, the field value must be unique within the corresponding… |
| Encrypted | string | no | Specifies whether to encrypt the field. If this parameter is set to true, the data value is encrypted at the storage layer |
| Required | string | no | Specifies whether the field is required |
| UserPermission | string | no | The field permission on the portal side. Valid values: hide: Not visible on the portal side. read_only: Visible on the portal side but… |
| Description | string | no | The field description. Maximum length: 512 characters |

### You can create custom terms
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-custom-privacy-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| CustomPrivacyPolicyName | string | yes | The name of the custom privacy policy |
| Status | string | no | The status of the custom privacy policy |
| UserConsentType | string | no | The consent type for the privacy policy |
| DefaultLanguageCode | string | no | The default language of the privacy policy |
| CustomPrivacyPolicyContents | string | no | The details of the custom privacy policy content (JSON-encoded) |
| ClientToken | string | no | A client token used to ensure the idempotence of the request. The client generates this value to make sure that it is unique among… |

### Creates a custom domain name for an EIAM (Entity and Identity Access Management) instance
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-domain` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| Domain | string | yes | The domain name |
| Filing | string | no | The parameters for ICP filing information (JSON-encoded) |

### Creates a proxy token for a domain name of an Employee Identity and Access Management (EIAM) instance
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-domain-proxy-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| DomainId | string | yes | The domain name ID |

### Creates a federated trust source
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-federated-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| FederatedCredentialProviderName | string | yes | The name of the federated trust source |
| FederatedCredentialProviderType | string | yes | The type of the federated trust source |
| NetworkAccessEndpointId | string | no | The ID of the network access endpoint |
| Description | string | no | The description of the federated trust source |
| PrivateCaProviderConfig | string | no | The private CA configuration (JSON-encoded) |
| OidcProviderConfig | string | no | The OIDC configuration (JSON-encoded) |
| Pkcs7ProviderConfig | string | no | The PKCS7 configuration (JSON-encoded) |
| CloudIdPProviderConfig | string | no | The identity provider configuration (JSON-encoded) |

### Create an EIAM account group
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | Instance ID |
| GroupName | string | yes | Group name. The maximum length is 64 characters |
| GroupExternalId | string | no | Group external ID, used for association with external systems. The default value is the group ID. The maximum length is 64 characters |
| Description | string | no | Description. The maximum length is 256 characters |

### Creates an identity provider
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-identity-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| IdentityProviderName | string | yes | The identity provider name |
| IdentityProviderType | string | yes | The synchronization type of the identity provider. Valid values: Inbound DingTalk: urn:alibaba:idaas:idp:alibaba:dingtalk:pull Outbound… |
| UdPushConfig | string | no | The outbound synchronization configuration (JSON-encoded) |
| UdPullConfig | string | no | The inbound synchronization configuration (JSON-encoded) |
| AuthnConfig | string | no | The authentication configuration (JSON-encoded) |
| BindingConfig | string | no | The account binding rule configuration for the OIDC identity provider (JSON-encoded) |
| DingtalkAppConfig | string | no | The DingTalk configuration information (JSON-encoded) |
| LdapConfig | string | no | The AD/LDAP configuration information (JSON-encoded) |
| WeComConfig | string | no | The WeCom configuration information (JSON-encoded) |
| OidcConfig | string | no | The OIDC IdP configuration (JSON-encoded) |
| NetworkAccessEndpointId | string | no | The network access endpoint ID |
| AutoCreateUserConfig | string | no | The automatic creation rule configuration for accounts (JSON-encoded) |
| AutoUpdateUserConfig | string | no | The automatic account update rule configuration (JSON-encoded) |
| LarkConfig | string | no | The Lark configuration information (JSON-encoded) |
| LogoUrl | string | no | The application logo URL |
| ClientToken | string | no | The client token that is used to ensure the idempotence of the request. Generate a parameter value from your client to ensure that the… |
| SamlConfig | string | no | The SAML IdP configuration (JSON-encoded) |

### Creates a status check job for an identity provider
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-identity-provider-status-check-job` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The ID of the instance |
| IdentityProviderId | string | yes | The ID of the identity provider |

### Creates an instance. All EIAM product capabilities are provided based on instances
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| Description | string | no | The description of the instance. The description can be up to 128 characters in length |
| ClientToken | string | no | The client token that is used to ensure the idempotence of the request. Generate a parameter value from your client to ensure that the… |

### Creates a trial License for an instance
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-instance-trial-license` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |

### Creates a network access endpoint
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-network-access-endpoint` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | Instance ID |
| NetworkAccessEndpointName | string | yes | Network access endpoint name |
| VpcId | string | yes | VPC ID connected to the network access endpoint |
| VpcRegionId | string | yes | Region of the VPC ID connected to the network access endpoint |
| VSwitchIds | string | no | List of specified vSwitches connected to the network access endpoint (JSON-encoded) |
| ClientToken | string | no | Ensures the idempotency of the request. Generate a parameter value from your client to ensure uniqueness across different requests.… |

### Creates a network zone object
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-network-zone` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | Instance ID |
| NetworkZoneName | string | yes | Network zone name |
| Description | string | no | Network zone description |
| NetworkZoneType | string | yes | Network zone type |
| Ipv4Cidrs | string | no | Network zone IPv4 CIDR blocks (JSON-encoded) |
| Ipv6Cidrs | string | no | Network zone IPv6 CIDR blocks (JSON-encoded) |
| VpcId | string | no | VPC ID |
| ClientToken | string | no | Idempotency token |

### Creates an EIAM organization under a specified organization
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-organizational-unit` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | Instance ID |
| OrganizationalUnitName | string | yes | Organization name. The maximum length is 64 characters |
| ParentId | string | yes | Parent organization ID |
| OrganizationalUnitExternalId | string | no | External ID of the organization, which is used for association with an external system. The default value is the organization ID. The… |
| Description | string | no | The description. The maximum length is 256 characters |

### Creates a scope permission for a specified resource server
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-resource-server-scope` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ResourceServerScopeName | string | yes | The name of the scope permission |
| ResourceServerScopeValue | string | yes | The value of the scope permission |
| ResourceServerScopeType | string | yes | The type of the scope permission |
| AuthorizationType | string | no | The authorization type. This parameter is required for user permissions |

### Creates a trusted origin
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-trusted-origin` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The ID of the IDaaS EIAM instance |
| TrustOriginName | string | no | The name of the trusted origin used for management, display, and auditing. If this parameter is not specified, the value is empty |
| Origin | string | yes | The browser origin in the format of scheme://host[:port]. This value cannot be modified after creation |
| TrustedOriginScene | string | yes | The trusted origin scenes. Only iframe_embed and cors are supported. At least one value is required (JSON-encoded) |
| ClientToken | string | no | The client token that is used to ensure the idempotence of the request. Generate a parameter value from your client to ensure that the… |

### Creates an EIAM account in a specified EIAM instance
`POST https://apizie.tech/v1/cloud:aliyun-eiam/create-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| Username | string | yes | The username. The username can contain letters, digits, underscores (_), periods (.), at signs (@), and hyphens (-). The username can be… |
| DisplayName | string | no | The display name of the account. The display name can be up to 128 characters in length |
| Password | string | no | The password. The password must meet the requirements of the password policy |
| PhoneRegion | string | no | The phone region code. The value is a 1 to 6-digit number and does not include a plus sign (+) |
| PhoneNumber | string | no | The phone number. The value is a 6 to 15-digit number |
| PhoneNumberVerified | string | no | Specifies whether the phone number is verified as a trusted phone number. This parameter is required if PhoneNumber is specified. If no… |
| Email | string | no | The email address. The email prefix can contain uppercase letters, lowercase letters, digits, periods (.), underscores (_), and hyphens… |
| EmailVerified | string | no | Specifies whether the email address is verified as a trusted email address. This parameter is required if Email is specified. If no… |
| UserExternalId | string | no | The external ID of the account. This parameter is used to associate the account with an external system. The value can be up to 128… |
| PrimaryOrganizationalUnitId | string | yes | The ID of the primary organizational unit |
| OrganizationalUnitIds | string | no | The list of organizational unit IDs to which the account belongs. An account can belong to multiple organizational units (JSON-encoded) |
| Description | string | no | The description. The description can be up to 256 characters in length |
| CustomFields | string | no | The list of custom fields (JSON-encoded) |
| PasswordInitializationConfig | string | no | The password initialization configuration (JSON-encoded) |
| ClientToken | string | no | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but you must… |

### Deletes an EIAM application resource
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |

### Deletes a client secret of an EIAM application
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-application-client-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| SecretId | string | yes | The client secret ID of the application |

### Deletes a federated identity credential of an application
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-application-federated-credential` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ApplicationFederatedCredentialId | string | yes | The application federated identity credential ID |

### Deletes an application role
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-application-role` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ApplicationRoleId | string | yes | The application role ID |

### Deletes an ApplicationToken
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-application-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ApplicationTokenId | string | yes | The application token ID |

### Deletes an authorized resource
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-authorization-resource` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| AuthorizationRuleId | string | yes | The authorization rule ID |
| AuthorizationResourceId | string | yes | The authorized resource ID |

### Deletes an authorization rule. The authorization rule can be deleted only when it is in the disabled state
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-authorization-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| AuthorizationRuleId | string | yes | The authorization rule ID |

### Delete Brand
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-brand` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | Instance ID |
| BrandId | string | yes | Brand ID |

### Deletes a specified application ClientPublicKey
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-client-public-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ClientPublicKeyId | string | yes | The ID of the application ClientPublicKey |

### Deletes an Alibaba Cloud account resource
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-cloud-account` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| CloudAccountId | string | yes | The ID of the Alibaba Cloud account |

### Deletes a cloud role from a specified Alibaba Cloud account
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-cloud-account-role` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| CloudAccountId | string | yes | The ID of the Alibaba Cloud account |
| CloudAccountRoleId | string | yes | The ID of the cloud role |

### Deletes a conditional access policy
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-conditional-access-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ConditionalAccessPolicyId | string | yes | The ID of the conditional access policy |

### Deletes a credential resource
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-credential` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | Instance ID |
| CredentialId | string | yes | Credential ID |

### Deletes a credential provider
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| CredentialProviderId | string | yes | The credential provider ID |

### Deletes an extended character field
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-custom-field` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| FieldId | string | yes | The field ID |

### Deletes a custom clause
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-custom-privacy-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| CustomPrivacyPolicyId | string | yes | The custom clause ID |

### Deletes a custom domain name of a specified Employee Identity and Access Management (EIAM) instance.…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-domain` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| DomainId | string | yes | The domain name ID |

### Deletes a proxy token for a specified domain name of an EIAM instance. Only proxy tokens in the disabled…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-domain-proxy-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| DomainId | string | yes | The domain name ID |
| DomainProxyTokenId | string | yes | The domain proxy token ID |

### Deletes a federated credential provider
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-federated-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| FederatedCredentialProviderId | string | yes | The ID of the federated credential provider |

### Delete an EIAM account group
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | Instance ID |
| GroupId | string | yes | Group ID |

### Deletes an identity provider
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-identity-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| IdentityProviderId | string | yes | The identity provider ID |

### Deletes an Employee Identity and Access Management (EIAM) instance that you no longer use
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID of the instance to delete |

### Deletes a dedicated network access endpoint
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-network-access-endpoint` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| NetworkAccessEndpointId | string | yes | The ID of the dedicated network access endpoint. Only network access endpoints whose NetworkEndpointType is private can be deleted |

### Deletes a network zone object
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-network-zone` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| NetworkZoneId | string | yes | The network zone ID |

### Deletes a specified EIAM organizational unit. The deletion fails if the organizational unit contains EIAM…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-organizational-unit` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| OrganizationalUnitId | string | yes | The organizational unit ID |

### Deletes all data of a specified organization. This operation can force delete all accounts and…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-organizational-unit-children` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| OrganizationalUnitId | string | yes | The organization ID |

### Deletes a scope permission under a specified ResourceServer
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-resource-server-scope` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ResourceServerScopeId | string | yes | The scope permission ID under the ResourceServer |

### Deletes a trusted origin from a specified EIAM instance
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-trusted-origin` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| TrustedOriginId | string | yes | The trusted origin ID |
| ClientToken | string | no | The idempotence token |

### Deletes a specified EIAM account and purges all information associated with the account
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| UserId | string | yes | The account ID |

### Deletes multiple accounts in a batch
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-users` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| UserIds | string | yes | A list of account IDs (JSON-encoded) |

### Deletes the specified WebAuthn authenticator
`POST https://apizie.tech/v1/cloud:aliyun-eiam/delete-web-authn-authenticator` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| UserId | string | yes | The user ID |
| AuthenticatorId | string | yes | The authenticator ID |

### Disables an application by changing its status from enabled to disabled, making all capabilities of the…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |

### Disables the Developer API feature for an Employee Identity and Access Management (EIAM) application
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-application-api-invoke` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The ID of the instance |
| ApplicationId | string | yes | The ID of the application |

### Disables a client key of an Employee Identity and Access Management (EIAM) application
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-application-client-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The ID of the instance |
| ApplicationId | string | yes | The ID of the application for which you want to disable a client key |
| SecretId | string | yes | The client key ID of the application |

### Disables a federated identity credential for an application
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-application-federated-credential` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ApplicationFederatedCredentialId | string | yes | The application federated identity credential ID |

### Disables the machine-to-machine (M2M) client feature for an application. This feature enables an application…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-application-m2-mclient` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |

### Disables the account synchronization feature for an application in Identity as a Service (IDaaS) Employee…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-application-provisioning` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The ID of the instance |
| ApplicationId | string | yes | The ID of the application |

### Disables the ResourceServer capability of a specified application
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-application-resource-server` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |

### Disables the single sign-on (SSO) feature for an Employee Identity and Access Management (EIAM) application.…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-application-sso` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |

### Disables an application token
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-application-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ApplicationTokenId | string | yes | The application token ID |

### Disables an authorization rule
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-authorization-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| AuthorizationRuleId | string | yes | The authorization rule ID |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but make… |

### Disables a brand
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-brand` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| BrandId | string | yes | The brand ID |

### Disables a specified application ClientPublicKey
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-client-public-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ClientPublicKeyId | string | yes | The ID of the application ClientPublicKey |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but you must… |

### Disables a cloud role for a specified Alibaba Cloud account
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-cloud-account-role` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| CloudAccountId | string | yes | The Alibaba Cloud account ID |
| CloudAccountRoleId | string | yes | The cloud role ID |
| ClientToken | string | yes | A client token to ensure the idempotence of the request. Generate a unique value from your client for this parameter. The token can… |

### Disables a conditional access policy
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-conditional-access-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ConditionalAccessPolicyId | string | yes | The conditional access policy ID |

### Disables a credential resource
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-credential` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The ID of the instance |
| CredentialId | string | yes | The ID of the credential |
| ClientToken | string | yes | Ensure idempotence. Generate a unique value on your client for each request. ClientToken supports only ASCII characters and must be no… |

### Disables a credential provider
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| CredentialProviderId | string | yes | The credential provider ID |

### Disables a field
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-custom-field` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| FieldId | string | yes | The field ID |

### Disables a custom term
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-custom-privacy-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| CustomPrivacyPolicyId | string | yes | The ID of the custom term |

### Disables a specified domain proxy token for an EIAM instance. After the token is disabled, domain usage is…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-domain-proxy-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| DomainId | string | yes | The domain ID |
| DomainProxyTokenId | string | yes | The domain proxy token ID |

### Disables a federated credential provider
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-federated-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| FederatedCredentialProviderId | string | yes | The federated credential provider ID |

### Disables the advanced configuration
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-identity-provider-advanced-ability` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| IdentityProviderId | string | yes | The identity provider ID |

### Disables authentication
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-identity-provider-authn` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| IdentityProviderId | string | yes | The identity provider ID |

### Disables the inbound synchronization feature of an identity provider
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-identity-provider-ud-pull` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| IdentityProviderId | string | yes | The identity provider ID |

### Disables automatic redirect from the initialization domain to the default domain for an EIAM instance. After…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-init-domain-auto-redirect` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | Instance ID |

### Disables an internal authentication source
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-internal-authentication-source` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| AuthenticationSourceId | string | no | The ID of the internal authentication source |

### Disables the custom subject feature for a specified resource server
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-resource-server-custom-subject` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |

### Disables a trusted origin in a specified EIAM instance
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-trusted-origin` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The ID of the IDaaS EIAM instance |
| TrustedOriginId | string | yes | The ID of the trusted origin |

### Sets an account status to disabled. If the account is already disabled, the operation returns success directly
`POST https://apizie.tech/v1/cloud:aliyun-eiam/disable-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| UserId | string | yes | The account ID |

### Enables a disabled Employee Identity and Access Management (EIAM) application
`POST https://apizie.tech/v1/cloud:aliyun-eiam/enable-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The ID of the instance |
| ApplicationId | string | yes | The ID of the application that you want to enable |

### You can call the EnableApplicationApiInvoke operation to enable Developer API calls for an EIAM application
`POST https://apizie.tech/v1/cloud:aliyun-eiam/enable-application-api-invoke` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |

### Enables the client key of an application in Identity as a Service (IDaaS) Employee Identity and Access…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/enable-application-client-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The ID of the instance |
| ApplicationId | string | yes | The ID of the application |
| SecretId | string | yes | The client key ID of the application |

### Enables an application federated credential
`POST https://apizie.tech/v1/cloud:aliyun-eiam/enable-application-federated-credential` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The ID of the instance |
| ApplicationId | string | yes | The ID of the application |
| ApplicationFederatedCredentialId | string | yes | The ID of the application federated credential |

### Enables the machine-to-machine (M2M) client feature for an application. This allows the application to act…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/enable-application-m2-mclient` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |

### Enables the account synchronization feature for an application in Identity as a Service (IDaaS) Employee…
`POST https://apizie.tech/v1/cloud:aliyun-eiam/enable-application-provisioning` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The ID of the instance |
| ApplicationId | string | yes | The ID of the application |

### Enables the ResourceServer feature for a specified application
`POST https://apizie.tech/v1/cloud:aliyun-eiam/enable-application-resource-server` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |

### Enables the SSO feature for an EIAM application
`POST https://apizie.tech/v1/cloud:aliyun-eiam/enable-application-sso` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |

### Enables an application token
`POST https://apizie.tech/v1/cloud:aliyun-eiam/enable-application-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ApplicationTokenId | string | yes | The application token ID |

### Enables an authorization rule
`POST https://apizie.tech/v1/cloud:aliyun-eiam/enable-authorization-rule` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| AuthorizationRuleId | string | yes | The authorization rule ID |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but you must… |

### Enables a brand
`POST https://apizie.tech/v1/cloud:aliyun-eiam/enable-brand` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| BrandId | string | yes | The brand ID |

### Enables a specified application ClientPublicKey
`POST https://apizie.tech/v1/cloud:aliyun-eiam/enable-client-public-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://eiam.ap-southeast-1.aliyuncs.com |
| InstanceId | string | yes | The instance ID |
| ApplicationId | string | yes | The application ID |
| ClientPublicKeyId | string | yes | The ID of the application ClientPublicKey |
| ClientToken | string | yes | The client token that is used to ensure the idempotence of the request. You can use the client to generate a parameter value, but you must… |

…and 238 more. See the OpenAPI spec.

## Example
```
curl "https://apizie.tech/v1/cloud:aliyun-eiam/add-application-account-to-user" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Alibaba Cloud Identity as a service API?
Create a free Apizie key, then send POST https://apizie.tech/v1/cloud:aliyun-eiam/add-application-account-to-user with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Alibaba Cloud Identity as a service API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Alibaba Cloud Identity as a service itself also needs your own key from aliyuncs.com.

### Can AI agents use the Alibaba Cloud Identity as a service API?
Yes. Add the Apizie MCP server (https://apizie.tech/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:aliyun-eiam.

### What is the status of the Alibaba Cloud Identity as a service API?
Needs your own provider key (bring your own key)