Contents x
GenerateIamRoleCredentials
    • Print
    • Dark
      Light
    Contents

    GenerateIamRoleCredentials

      • Print
      • Dark
        Light
      Article summary

      Post
      /v1/accounts/{accountId}:generateIamRoleCredentials

      Availability

      Early Access: July 1, 2026

      Early Access is gated; contact the Backblaze Sales team for access.

      Limited Availability: July 1, 2026

      This API is available only to customers with access to the Backblaze Enterprise Web Console. For more information, contact the Backblaze Sales team.

      Generate short-lived AWS-compatible credentials for an IAM role in an account

      Returns temporary AWS-compatible credentials (accessKeyId, secretAccessKey, sessionToken) scoped to an IAM role in a target account within the organization. This behaves like the AWS Identity Center GetRoleCredentials API.

      Notes

      • iamRole is the friendly role name (not an ARN). If omitted, defaults to OrganizationAccountAccessRole.
      • accountId in the path must be the account that contains the role.
      • If neither expireTime nor ttl is supplied, the server uses a default session duration of 3600 seconds.
      • ttl must be specified using protobuf Duration JSON format (for example 900s, 3600s, or 43200s).
      • ttl must be between 900 and 43200 seconds, inclusive.
      • Returned credentials are temporary and must be refreshed by calling this API again when expired.

      Default policy

      The default role is OrganizationAccountAccessRole with an inline policy equivalent to AWS AdministratorAccess (full access to all B2 and IAM actions/resources in the account).

      Security
      HTTP
      Type bearer

      Short-lived bearer token obtained from GET /orgs/v1/authorize. Sent as Authorization - Bearer .

      Path parameters
      accountId
      stringRequired

      The numeric identifier of the account. Valid account IDs match 9[0-4][0-9]{10}.

      Pattern^9[0-4][0-9]{10}$
      Example912345678901
      Body parameters
      defaultRole

      Default role with default TTL

      {}
      withTtl

      Explicit role and TTL

      {
  "iamRole": "AnalyticsRole",
  "ttl": "3600s"
}
      withExpireTime

      Explicit role and absolute expireTime

      {
  "iamRole": "AnalyticsRole",
  "expireTime": "2026-02-03T22:10:00Z"
}
      object
      iamRole
      string

      The friendly name (not ARN) of the IAM role to assume. Defaults to OrganizationAccountAccessRole.

      ExampleAnalyticsRole
      expireTime
      string (date-time)

      Optional absolute expiration of the issued session. Mutually exclusive with ttl.

      Example2026-02-03T22:10:00Z
      ttl
      string

      Optional duration string in protobuf Duration JSON format. Must be between 900s and 43200s inclusive.

      Pattern^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$
      Example3600s
      Responses
      200

      The request succeeded.

      {
  "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
  "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
  "sessionToken": "IQoJb3JpZ2luX2VjE...",
  "expireTime": "2026-02-03T22:10:00Z"
}
      object
      accessKeyId
      string

      AWS-compatible temporary access key ID. Prefixed with ASIA.

      ExampleASIAIOSFODNN7EXAMPLE
      secretAccessKey
      string

      AWS-compatible temporary secret access key.

      ExamplewJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
      sessionToken
      string

      AWS-compatible session token.

      ExampleIQoJb3JpZ2luX2VjE...
      expireTime
      string (date-time)

      RFC 3339 UTC timestamp at which the issued credentials expire.

      Example2026-02-03T22:10:00Z
      400

      The request was malformed or failed validation.

      HTTP StatusCodeDescription
      400INVALID_ARGUMENTOne or more request parameters were invalid.
      Expand All
      object
      requestId
      string

      Opaque correlation identifier matching the Request-Id response header. Include in support requests.

      Example4bf92f3577b34da6a3ce929d0e0e4736
      error
      object
      code
      integer

      Numeric error code.

      Example10
      message
      string

      Human-readable description of the error.

      Exampleetag mismatch
      details
      object

      Reserved for structured, non-sensitive diagnostic information related to the error condition.

      401

      The request was not authenticated.

      HTTP StatusCodeDescription
      401UNAUTHORIZEDMissing, expired, or invalid bearer token.
      Expand All
      object
      requestId
      string

      Opaque correlation identifier matching the Request-Id response header. Include in support requests.

      Example4bf92f3577b34da6a3ce929d0e0e4736
      error
      object
      code
      integer

      Numeric error code.

      Example10
      message
      string

      Human-readable description of the error.

      Exampleetag mismatch
      details
      object

      Reserved for structured, non-sensitive diagnostic information related to the error condition.

      403

      The caller is not authorized to perform this operation.

      HTTP StatusCodeDescription
      403FORBIDDENThe authenticated principal lacks permission for this action.
      Expand All
      object
      requestId
      string

      Opaque correlation identifier matching the Request-Id response header. Include in support requests.

      Example4bf92f3577b34da6a3ce929d0e0e4736
      error
      object
      code
      integer

      Numeric error code.

      Example10
      message
      string

      Human-readable description of the error.

      Exampleetag mismatch
      details
      object

      Reserved for structured, non-sensitive diagnostic information related to the error condition.

      404

      The requested resource was not found.

      HTTP StatusCodeDescription
      404NOT_FOUNDThe resource does not exist or has been purged.
      Expand All
      object
      requestId
      string

      Opaque correlation identifier matching the Request-Id response header. Include in support requests.

      Example4bf92f3577b34da6a3ce929d0e0e4736
      error
      object
      code
      integer

      Numeric error code.

      Example10
      message
      string

      Human-readable description of the error.

      Exampleetag mismatch
      details
      object

      Reserved for structured, non-sensitive diagnostic information related to the error condition.

      429

      The request was rate-limited.

      HTTP StatusCodeDescription
      429TOO_MANY_REQUESTSRate limit exceeded. Use exponential backoff.
      Expand All
      object
      requestId
      string

      Opaque correlation identifier matching the Request-Id response header. Include in support requests.

      Example4bf92f3577b34da6a3ce929d0e0e4736
      error
      object
      code
      integer

      Numeric error code.

      Example10
      message
      string

      Human-readable description of the error.

      Exampleetag mismatch
      details
      object

      Reserved for structured, non-sensitive diagnostic information related to the error condition.

      500

      The server encountered an unexpected condition.

      HTTP StatusCodeDescription
      500INTERNALUnexpected server error. Include the requestId when contacting support.
      Expand All
      object
      requestId
      string

      Opaque correlation identifier matching the Request-Id response header. Include in support requests.

      Example4bf92f3577b34da6a3ce929d0e0e4736
      error
      object
      code
      integer

      Numeric error code.

      Example10
      message
      string

      Human-readable description of the error.

      Exampleetag mismatch
      details
      object

      Reserved for structured, non-sensitive diagnostic information related to the error condition.

      Was this article helpful?
      What's Next