{"openapi":"3.1.0","info":{"title":"Converge Cloud — Security Token Service (sts)","version":"2018-08-13","summary":"2 actions.","description":"Endpoint `https://sts.api3.convergecloud.com`, region `luzon`, `X-TC-Version: 2018-08-13`.\n\nA wrong `X-TC-Version` returns `InvalidAction`, which is indistinguishable from a missing action — this was the single largest source of false “absent” verdicts in our own measurements."},"servers":[{"url":"https://sts.api3.convergecloud.com","description":"Converge Cloud production (luzon — the only region)"}],"x-cc-wire-protocol":{"style":"RPC over HTTP POST","realPath":"/","actionHeader":"X-TC-Action","versionHeader":"X-TC-Version","version":"2018-08-13","note":"Every operation in this document is really `POST /` to the server above with `X-TC-Action: <Action>`. Paths of the form `/sts/<Action>` exist so the actions are individually addressable, linkable and renderable; they are not routes on the server.","signing":"TC3-HMAC-SHA256","region":"luzon","clockSkewSeconds":300},"security":[{"TC3":[]}],"tags":[{"name":"sts","description":"Security Token Service"}],"paths":{"/sts/GetFederationToken":{"post":{"operationId":"sts_GetFederationToken","summary":"GetFederationToken","description":"Get temporary credentials for a federated user.\nIssues temporary credentials. Converge Cloud provides no revocation mechanism; the credentials remain valid until they expire.\n**Wire call.** This path is a documentation convenience. Converge Cloud is RPC-over-HTTP: every action is a single `POST /` to `sts.api3.convergecloud.com` with the action name in the `X-TC-Action` header. The real request is:\n```bash\ncurl -sS https://sts.api3.convergecloud.com/ \\\n  -H 'Authorization: TC3-HMAC-SHA256 Credential=<SecretId>/<YYYY-MM-DD>/sts/tc3_request, SignedHeaders=content-type;host;x-tc-action, Signature=<sig>' \\\n  -H 'Content-Type: application/json; charset=utf-8' \\\n  -H 'Host: sts.api3.convergecloud.com' \\\n  -H 'X-TC-Action: GetFederationToken' \\\n  -H 'X-TC-Version: 2018-08-13' \\\n  -H 'X-TC-Timestamp: <unix-seconds>' \\\n  -H 'X-TC-Region: luzon' \\\n  -d '{\"Name\":\"<Name>\",\"Policy\":\"<Policy>\"}'\n```","tags":["sts"],"deprecated":false,"x-cc-service":"sts","x-cc-action":"GetFederationToken","x-cc-version":"2018-08-13","x-cc-mutating":true,"x-cc-required-params":["Name","Policy"],"x-cc-notable-params":["DurationSeconds"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"Name":{"type":"string"},"Policy":{"type":"string"},"DurationSeconds":{"type":"string","description":"Optional."}},"required":["Name","Policy"],"additionalProperties":true,"description":"The fields listed here are the ones in common use. Additional parameters are also accepted."},"example":{"Name":"<Name>","Policy":"<Policy>"}}}},"responses":{"200":{"description":"Converge Cloud answers 200 for both success and error. Read `Response.Error` to tell them apart — never the HTTP status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"}}}}}}},"/sts/AssumeRole":{"post":{"operationId":"sts_AssumeRole","summary":"AssumeRole","description":"Request for the temporary security credentials of a role.\nIssues temporary credentials. Converge Cloud provides no revocation mechanism; the credentials remain valid until they expire.\n**Wire call.** This path is a documentation convenience. Converge Cloud is RPC-over-HTTP: every action is a single `POST /` to `sts.api3.convergecloud.com` with the action name in the `X-TC-Action` header. The real request is:\n```bash\ncurl -sS https://sts.api3.convergecloud.com/ \\\n  -H 'Authorization: TC3-HMAC-SHA256 Credential=<SecretId>/<YYYY-MM-DD>/sts/tc3_request, SignedHeaders=content-type;host;x-tc-action, Signature=<sig>' \\\n  -H 'Content-Type: application/json; charset=utf-8' \\\n  -H 'Host: sts.api3.convergecloud.com' \\\n  -H 'X-TC-Action: AssumeRole' \\\n  -H 'X-TC-Version: 2018-08-13' \\\n  -H 'X-TC-Timestamp: <unix-seconds>' \\\n  -H 'X-TC-Region: luzon' \\\n  -d '{\"RoleArn\":\"<RoleArn>\",\"RoleSessionName\":\"<RoleSessionName>\"}'\n```","tags":["sts"],"deprecated":false,"x-cc-service":"sts","x-cc-action":"AssumeRole","x-cc-version":"2018-08-13","x-cc-mutating":true,"x-cc-required-params":["RoleArn","RoleSessionName"],"x-cc-notable-params":["DurationSeconds","Policy"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"RoleArn":{"type":"string"},"RoleSessionName":{"type":"string"},"DurationSeconds":{"type":"string","description":"Optional."},"Policy":{"type":"string","description":"Optional."}},"required":["RoleArn","RoleSessionName"],"additionalProperties":true,"description":"The fields listed here are the ones in common use. Additional parameters are also accepted."},"example":{"RoleArn":"<RoleArn>","RoleSessionName":"<RoleSessionName>"}}}},"responses":{"200":{"description":"Converge Cloud answers 200 for both success and error. Read `Response.Error` to tell them apart — never the HTTP status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"}}}}}}}},"components":{"securitySchemes":{"TC3":{"type":"apiKey","in":"header","name":"Authorization","description":"TC3-HMAC-SHA256. Credential scope is `<YYYY-MM-DD>/sts/tc3_request`. The signing service name is a separate input from the hostname — deriving it from the host works until it does not, and the failure looks like an auth bug. Timestamps outside a 300-second window are rejected."}},"schemas":{"Envelope":{"type":"object","description":"Every Converge Cloud response is wrapped in `Response`, success or failure.","properties":{"Response":{"type":"object","properties":{"RequestId":{"type":"string","description":"Always present, including on errors. Quote it to Converge support."},"Error":{"$ref":"#/components/schemas/Error"}},"required":["RequestId"],"additionalProperties":true}},"required":["Response"]},"Error":{"type":"object","description":"Present only on failure. Error messages are Chinese on vpc and dc and English elsewhere — parse `Code`, never `Message`.","properties":{"Code":{"type":"string","examples":["InvalidAction","UnauthorizedOperation","AuthFailure.SignatureFailure","ResourceNotFound","InvalidParameterValue.LimitExceeded"]},"Message":{"type":"string"}},"required":["Code","Message"]}}}}