Update an account's alternate contact

PUT 
/accounts/:accountId/contacts/:type

Sets one of an AWS account's three alternate contacts: billing, operations or security.

This is a replace, not a merge. It maps onto the AWS PutAlternateContact call, which overwrites the whole contact. AWS wants all four fields; a field you omit is cleared, not preserved.

Prism validates nothing in the body beyond it being valid JSON, and nothing in {type} at all. Both are forwarded as sent, so AWS's rules are the only rules and a body that breaks them fails upstream as a 502.

Like the other five contacts operations, this one is a proxy to CloudKeeper's ops-service, is present on every deployment, and reports every upstream failure as a 502; see POST /accounts/{accountId}/contacts/get for the full explanation.

Request

Responses

200

The ops-service accepted the update and AWS applied it. The response carries no data, and message is the fixed string Alternate contact updated, the same string for all three contact types.

400

The request body is not valid JSON. This is the only thing about the body that Prism checks.

401

Authentication failed: the X-API-Token header was missing, malformed, expired or not recognised.

This response is text/plain, not JSON. It is written by http.Error in the authentication middleware, which runs before any handler and therefore before anything that would build a JSON envelope. A client that unconditionally JSON-parses response bodies will fail on this one, so check the status code first.

403

The token is valid, but it is not allowed to act on this tenant.

An API token is minted inside one tenant and stays bound to it for life. Sending it to a path whose tenant segment names a different tenant is refused here, in middleware, before the operation runs, so this says nothing about the resource you asked for, only about which tenant the path named. Check the tenant server variable against the console the token was created in.

404

No tenant matches the tenant segment of the request path. Neither an AWS account that does not exist nor an unrecognised {type} is a 404; both are 502.

502

The update did not happen. Every upstream outcome lands here, including an unrecognised {type}, an account that does not exist, an unpaired self-hosted install, and an AWS rejection of the contact fields. message carries the upstream reason verbatim.