Skip to main content
PATCH
Edit the role ARN, External ID or OUs of a Cloud Compass credential

Authorizations

Authorization
string
header
required

env zero API authentication is done via API keys. An API Key can either be created by an organization administrator, in which case it will not be connected to any specific user, or via Personal API Keys to authenticate as a user.

Creating an API Key with a Specific Role

  • Once you've created your organization, you can set up and manage API Keys.
  • Navigate to the Organization Settings page and click the API Keys tab.
  • Click Add API Key and enter a name for your key in the Name field. This name is for reference purposes only and isn't used directly in authentication.

❗️Save Your API Key ID and secret The secret will not be available after you close this window.

Creating a Personal API Key

  • Click on your avatar (located on the top right of the screen)
  • Click on Personal Settings
  • Select the API Keys tab
  • Click Add API Key, and enter a name for your key in the Name field. This name is for reference purposes and isn't used directly in authentication.

❗️Save your API Key ID & secret The secret will not be available after you close this window.

Using an API Key to Authenticate

Authentication of the env zero API is done using the Basic Authentication method. Each request made should include the API Key ID as the username, and the API Key secret as the password. For example, when using curl, we can include these parameters via flag --user {API Key ID}:{API Key Secret}.

API Key Permissions

When creating an API key through the organization settings, you will need to choose if you’d like to grant it Organization Admin or User permissions. In case of the latter, you can assign fine-grained permissions per project. Personal API Keys can be created through the user’s profile page and will have the same permissions as the user has.

Rate Limits

env zero API allows up to 1K requests per 60 seconds, requests are aggregated by IP, HTTP Method and URI. If you exceed this limit, you will receive a 429 status code.

Path Parameters

id
string
required

Body

application/json

Send at least one field besides organizationId. A field left out keeps its value.

organizationId
string
required
roleArn
string

The new role ARN, or management account role ARN in Organization mode. Must be in the credential's AWS account.

Pattern: ^arn:aws[a-z-]*:iam::\d{12}:role/.+$
externalId
string

The sts:ExternalId characters, without a comma. Update the role's trust policy first.

Required string length: 2 - 1224
Pattern: ^[\w+=.@:\/-]+$
organizationUnitIds
string[]

Organization mode only. The OUs Cloud Compass reads. Empty reads the whole Organization.

Maximum array length: 1000
Pattern: ^(ou-[0-9a-z]{4,32}-[a-z0-9]{8,32}|r-[0-9a-z]{4,32})$
skipAccountIds
string[]

Organization mode only. Member accounts Cloud Compass skips.

Maximum array length: 1000
Pattern: ^\d{12}$

Response

200 - application/json

An edit the syncs do not have yet. testing: CloudQuery tests the new settings. applying: env0 updates the same 4 syncs and the credential. failed: a test failed or timed out and nothing changed, or the apply kept failing. Each read of the credential moves an open edit on, so it waits while nobody reads it.

status
enum<string>
required
Available options:
testing,
applying,
failed
startedAt
string<date-time>
required
roleArn
string

Set when the edit changes the role ARN.

externalIdChanged
boolean

True when the edit changes the External ID.

organizationUnitIds
string[]

Set when the edit changes the OUs.

Pattern: ^(ou-[0-9a-z]{4,32}-[a-z0-9]{8,32}|r-[0-9a-z]{4,32})$
skipAccountIds
string[]

Set when the edit changes the skipped accounts.

Pattern: ^\d{12}$
testResults
object[]

The CloudQuery test connection result per feature.

failureReason
enum<string>

apply_failed: env0 could not update the syncs after the tests passed; some syncs may have the new settings.

Available options:
test_connection_failed,
test_connection_timeout,
apply_failed