List the Cedar action catalog.
curl --request GET \ --url https://stratum.example.com/v1/iam/actions \ --header 'Authorization: Bearer <token>'Every <service>:<Verb> action the install understands — the
policy builder’s action picker. Any authenticated principal.
Filters, both optional and combinable. resourceType
keeps the actions that can apply to a resource of that type: the
ones a resource policy on it accepts. available=true drops the
actions of a registry service that is switched off or does not
exist on this install’s profile (an action with no
registryService is always kept). conditionKeys and
resourceTypes are never filtered.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Query Parameters
Section titled “Query Parameters”A resource type token from resourceTypes (the ARN <type>),
e.g. instance. An unknown token is a 400
UNKNOWN_RESOURCE_TYPE.
true keeps only the actions whose registry service is on
here. false or absent returns the whole catalog.
Responses
Section titled “Responses”Action catalog.
object
One authorizable action enriched for the policy builder. service/verb/description/mutating are derived from the action string; group by service, label with description, badge read-vs-write with mutating.
object
The <service>:<Verb> action name.
Human label derived from the verb, e.g. “Start Instance”.
False for read actions (List/Describe/Get/Read/Verify/Detect).
Resource type token(s) the action targets, derived
from the verb via the resource-type registry. Absent/empty for
service-wide actions (Manage, Reconcile, Login, console
verbs). Values are the ARN <type> tokens in resourceTypes.
The service-registry key whose switch governs the action, e.g. db, s3, client-vpn, security. Absent
for the platform’s always-on services (compute, network, IAM,
…). The registry’s GET /v1/services reports whether that
key is on.
A condition key the builder can offer. v1 supports resource-tag
matching only; <key> is any tag key on the target resource.
object
The resource-type registry — the distinct types an
action’s resourceTypes can reference, for the builder’s
resource picker + display labels.
One authorizable resource type. type is the ARN
<type> token + resource-policy key prefix; display is the
human label; service is the owning service.
object
Example generated
{ "actions": [ { "action": "example", "service": "example", "verb": "example", "description": "example", "mutating": true, "resourceTypes": [ "example" ], "registryService": "example" } ], "conditionKeys": [ { "key": "example", "operators": [ "example" ], "description": "example" } ], "resourceTypes": [ { "type": "example", "service": "example", "display": "example" } ]}Bad request.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Missing or invalid token.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}