List instance profiles in the project.

GET

/v1/projects/{projectId}/iam/instance-profiles

Code sample: Shell / cURL

curl --request GET \
  --url 'https://stratum.example.com/v1/projects/example/iam/instance-profiles?limit=100' \
  --header 'Authorization: Bearer <token>'

• A Stratum cluster endpoint.

Returns every non-deleted instance profile in the project. Visible to project-viewer+.

Authorizations

• bearerAuth

Parameters

Path Parameters

projectId

required

string

/^p-[a-z0-9-]+$/

Query Parameters

limit

integer

default: 100 >= 1 <= 500

page_token

string

Opaque cursor from a previous response’s nextPageToken; omit for the first page. A token that cannot be parsed is treated as no token, so a client gets the first page rather than a 400.

Cursor-paginated. Ordered name, id — ordering on name alone is not a total order.

This endpoint returned every matching row with no limit of any kind until.

Responses

200

Instance profiles.

Media typeapplication/json

object

items

required

Array<object>

Binds an instance to a service account + Cedar trust policy + credential TTL. Apps inside a VM with the profile attached call IMDS; the trust policy decides whether the calling instance may assume the bound service account, and on a pass the IMDS path mints short-lived credentials. A profile enters orphaned when its backing service account is deleted.

object

id

required

string

/^iprof-[a-z0-9]+$/

projectId

required

string

/^p-[a-z0-9-]+$/

name

required

Machine identifier returned by the IMDS endpoint at /latest/meta-data/iam/security-credentials/<name>. Unique per project; immutable after create.

string

<= 100 characters

displayName

required

string

<= 100 characters

description

string

<= 1024 characters

serviceAccountId

required

string

/^sa-[a-z0-9]+$/

trustPolicy

required

Cedar trust policy — controls which instances may assume this profile.

string

credentialTtlSeconds

required

TTL of each minted credential. Default 3600, min 900, max 43200.

integer

>= 900 <= 43200

state

required

string

Allowed values: active orphaned deleted

createdAt

required

string format: date-time

updatedAt

required

string format: date-time

createdBy

required

string

nextPageToken

string

Example

{
  "items": [
    {
      "state": "active"
    }
  ]
}

401

Missing or invalid token.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

Headers

WWW-Authenticate

string

403

Authenticated but not authorized.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}