Skip to main content
GET
Get AWS delegated-grant setup artifacts

Authorizations

Authorization
string
header
required

A bearer JWT issued by plugin-auth (lib-auth). The tenant identity is resolved from the validated token claims; the /v1 surface never reads a tenant from the body, path, or query. Machine callers obtain a token via the plugin-auth client-credentials flow. The /admin surface authorizes against an operator scope and carries no tenant context.

Path Parameters

id
string<uuid>
required

The unique identifier of the subscription (UUIDv7).

Response

The delegated-grant artifacts.

externalId
string
required

The non-secret sts:ExternalId correlation value pinned into the trust policy (minted once, stable across re-fetches).

Example:

"0190a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b"

region
string
required

The AWS region the artifacts target.

Example:

"us-east-1"

trustPolicy
string
required

The cross-account IAM trust policy JSON (as a string) the customer applies in their AWS account.

Example:

"{ \"Version\": \"2012-10-17\", \"Statement\": [] }"

quickCreateUrl
string<uri>
required

A CloudFormation quick-create console link that provisions the delivery role.

Example:

"https://us-east-1.console.aws.amazon.com/cloudformation/home?..."