open-vault/website/source/api/auth/alicloud/index.html.md.erb

---
layout: "api"
page_title: "AliCloud - Auth Methods - HTTP API"
sidebar_title: "AliCloud"
sidebar_current: "api-http-auth-alicloud"
description: |-
  This is the API documentation for the Vault AliCloud auth method.
---

# AliCloud Auth Method (API)

This is the API documentation for the Vault AliCloud auth method. For
general information about the usage and operation of the AliCloud method, please
see the [Vault AliCloud auth method documentation](/docs/auth/alicloud.html).

This documentation assumes the AliCloud auth method is mounted at the `/auth/alicloud`
path in Vault. Since it is possible to enable auth methods at any location,
please update your API calls accordingly.

## Create Role

Registers a role. Only entities using the role registered using this endpoint 
will be able to perform the login operation.

| Method   | Path                             |
| :------------------------------- | :--------------------- |
| `POST`   | `/auth/alicloud/role/:role`      |

### Parameters

- `role` `(string: <required>)` - Name of the role. Must correspond with the name of the role reflected in the arn.
- `arn` `(string: <required>)` - The role's arn.

<%=partial("partials/tokenfields")%>

### Sample Payload

```json
{
  "arn": "acs:ram::5138828231865461:role/dev-role",
  "policies": [
    "dev",
    "prod"
  ]
}
```

### Sample Request

```
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/auth/alicloud/role/dev-role
```

## Read Role

Returns the previously registered role configuration.

| Method   | Path                         |
| :--------------------------- | :--------------------- |
| `GET`    | `/auth/alicloud/role/:role`  |

### Parameters

- `role` `(string: <required>)` - Name of the role.

### Sample Request

```
$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/auth/alicloud/role/dev-role
```

### Sample Response

```json
{
  "data": {
    "arn": "acs:ram::5138828231865461:role/dev-role",
    "policies": [
      "default",
      "dev",
      "prod"
    ],
    "ttl": 1800000,
    "max_ttl": 1800000,
    "period": 0
  }
}
```

## List Roles

Lists all the roles that are registered with the method.

| Method   | Path                         |
| :--------------------------- | :--------------------- |
| `LIST`   | `/auth/alicloud/roles`       |

### Sample Request

```
$ curl \
    --header "X-Vault-Token: ..." \
    --request LIST \
    http://127.0.0.1:8200/v1/auth/alicloud/roles
```

### Sample Response

```json
{
  "data": {
    "keys": [
      "dev-role",
      "prod-role"
    ]
  }
}
```

## Delete Role

Deletes the previously registered role.

| Method   | Path                             |
| :------------------------------- | :--------------------- |
| `DELETE` | `/auth/alicloud/role/:role`      |

### Parameters

- `role` `(string: <required>)` - Name of the role.

### Sample Request

```
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/auth/alicloud/role/dev-role
```

## Login

Fetch a token. This endpoint verifies the signature of the signed 
GetCallerIdentity request.

| Method   | Path                         |
| :--------------------------- | :--------------------- |
| `POST`   | `/auth/alicloud/login`       |

### Parameters

- `role` `(string: <required>)` - Name of the role.
- `identity_request_url` `(string: <required>)` - Base64-encoded HTTP URL used in
  the signed request.
- `identity_request_headers` `(string: <required>)` - Base64-encoded,
  JSON-serialized representation of the sts:GetCallerIdentity HTTP request
  headers. The JSON serialization assumes that each header key maps to either a
  string value or an array of string values (though the length of that array
  will probably only be one).


### Sample Payload

```json
{
  "role": "dev-role",
  "identity_request_url": "aWRlbnRpdHlabrVxdWVzdF91cmw=",
  "identity_request_headers": "aWRlimRpdHlfcmVxdWVzdF9oZWFkZXJz"
}
```

### Sample Request

```
$ curl \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/auth/alicloud/login
```

### Sample Response

```json
{
  "auth": {
    "renewable": true,
    "lease_duration": 1800000,
    "metadata": {
      "role_tag_max_ttl": "0",
      "instance_id": "i-de0f1344",
      "ami_id": "ami-fce36983",
      "role": "dev-role",
      "auth_type": "ec2",
      "account_id":    "5138828231865461",
      "user_id":       "216959339000654321",
      "role_id":       "4657-abcd",
      "arn":           "acs:ram::5138828231865461:assumed-role/dev-role/vm-ram-i-rj978rorvlg76urhqh7q",
      "identity_type": "assumed-role",
      "principal_id":  "vm-ram-i-rj978rorvlg76urhqh7q",
      "request_id":    "D6E46F10-F26C-4AA0-BB69-FE2743D9AE62",
      "role_name":     "dev-role"
    },
    "policies": [
      "default",
      "dev"
    ],
    "accessor": "20b89871-e6f2-1160-fb29-31c2f6d4645e",
    "client_token": "c9368254-3f21-aded-8a6f-7c818e81b17a"
  }
}
```