Onboard several AWS accounts
POST/accounts/onboard/bulk
Onboards a list of AWS accounts. Each one gets exactly the treatment
POST /accounts/onboard gives a single account. Read that operation for
what onboarding does to an AWS account, since all of it applies here, once
per entry.
Synchronous, and slow by construction. Accounts are processed thirty at a time and the request blocks until the last one finishes. Nothing is queued and there is no job to poll.
Partial success is a 200. This is the difference that matters between
this operation and the single-account one. A run in which nine of ten
accounts onboarded returns 200, and the tenth is visible only in
data.onboardingResult.account_errors. Never treat a 200 here as "all
accounts onboarded". Compare successful_onboarding against
total_accounts, or check that account_errors is empty. Only a run in
which nothing at all onboarded is reported as an error status.
Validation is all-or-nothing and runs first: one bad entry rejects the whole batch with a 400 naming its index, and no account is touched.
ownerEmails is not supported here: the bulk body has no such field, and
the accounts are onboarded with their owners untouched. Use
POST /accounts/onboard per account if you need to set them.
Request
Responses
- 200
- 400
- 401
- 403
- 404
- 500
- 502
At least one account onboarded. This does not mean all of them
did. Read data.onboardingResult for the per-account outcome.
The request was rejected before anything was attempted. Nothing in AWS and nothing in Prism changed, for any account in the list.
The causes are a body that is not valid JSON; an accounts array that
is absent or empty; an entry whose accountId is absent, not all
digits, or not exactly twelve digits; and an entry whose account name
contains a character outside ^[a-zA-Z0-9\-_.\s]+$. Entry failures
name the offending index in message, as Account at index 3: ....
Authentication failed: the X-API-Token header was missing, malformed,
expired or not recognised.
This response is text/plain, not JSON. It is written by
http.Error in the authentication middleware, which runs before any
handler and therefore before anything that would build a JSON envelope.
A client that unconditionally JSON-parses response bodies will fail on
this one, so check the status code first.
The token is valid, but it is not allowed to act on this tenant.
An API token is minted inside one tenant and stays bound to it for life.
Sending it to a path whose tenant segment names a different tenant is
refused here, in middleware, before the operation runs, so this says
nothing about the resource you asked for, only about which tenant the
path named. Check the tenant server variable against the console the
token was created in.
No tenant matches the tenant segment of the request path.
The onboarding run itself could not be carried out, or it reported no result at all.
Not one account onboarded. Every account in the list was attempted and every one failed on the AWS side.
message is the run summary, 0 of N accounts onboarded (F failed, S skipped), followed by the verbatim reason of the first failure and
the account it belongs to. The other reasons are not in this response;
re-run the accounts individually, or in smaller batches, to see them.
Accounts that succeeded do not reach here: any success at all makes the run a 200.