Introduction
The Prism customer API. Authenticate with a static API token minted from your
Users
The people in your tenant, held in its directory. Create, read, update and delete them, reset a password administratively, and resolve everything a single user can reach across AWS accounts and custom applications.
Groups
Directory groups and who belongs to them. Membership is how access is given to more than one person at once: a permission set assigned to a group is held by everyone in it, so adding a member grants real AWS access straight away.
Permission Sets
Reusable definitions of an AWS role, each a name, a session duration and the policies that role should carry. Defining one changes nothing in AWS by itself; it stays inert until it is assigned to a user or group for a particular account.
Permission Set Assignments
Grants of one permission set to one user or group on one AWS account, the records behind the IAM roles that actually exist. Creating one is only accepted here and provisioned in the background, so an assignment is not live the moment the call returns.
AWS Accounts
The AWS accounts your tenant works with: onboarding one or several so that Prism can reach into them, a pre-flight check that its role can be assumed, paginated listing and single-account reads of Prism's own records, and a guarded removal that refuses while permission set assignments still point at an account.
Account Contacts
The primary and alternate contact details AWS holds for an account, and the two-step change of the account's root email address. Prism forwards all six operations to CloudKeeper's ops service, which holds the payer-account access these calls need.