CAP

Issue temporary AWS credentials and list the accounts a caller may access through the CAP-compatible endpoints.

📄️List the caller's access

Returns the AWS roles assigned to the caller's account in the CAP cloud partition (the combine.tap.api.cap.cloudPartitionId Configuration Value, default AWS_C2S), grouped by agency, mission, and account number. The order of the entries is not defined. Authenticated with a client certificate. Requires the CAP API to be enabled.

📄️Get temporary AWS credentials

Returns temporary AWS credentials for an AWS role in the AWS_C2S cloud partition. Authenticated with a client certificate. Credentials are issued only for roles assigned to the caller's account. Requires the CAP API to be enabled.

📄️List account activity

Returns one summary per combination of client certificate subject DN, agency, mission, and role that obtained credentials for the account, most recent last_access first. Only trail events for AWS roles in the CAP cloud partition (the combine.tap.api.cap.cloudPartitionId Configuration Value, default AWS_C2S) are included. Trail events are recorded only when the combine.tap.trails.enable Configuration Value is true (default false); otherwise the array is empty. Requires the CAP API to be enabled.

📄️List account trail events

Returns a paginated list of credential issuance trail events for the account. Only trail events for AWS roles in the CAP cloud partition (the combine.tap.api.cap.cloudPartitionId Configuration Value, default AWS_C2S) are included. Trail events are recorded only when the combine.tap.trails.enable Configuration Value is true (default false); otherwise the array is empty. Requires the CAP API to be enabled.