# Alibaba Cloud Agent Identity API

> Alibaba Cloud Agent Identity API on Apizie: 83 endpoints (Creates an application, Associates a policy set with a gateway, Creates an API key credential provider, Creates a WorkloadIdentity, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://apizie.tech/v1/cloud:aliyun-agentidentity/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:aliyun-agentidentity`
- Category: Cloud
- Status: byok
- Source: https://api.alibabacloud.com/product/agentidentity
- Page: https://apizie.tech/api/cloud/aliyun-agentidentity
- OpenAPI: https://apizie.tech/api/cloud/aliyun-agentidentity/openapi.json

Alibaba Cloud OpenAPI for Agent Identity (agentidentity, version 2025-09-01). Calls are signed with ACS3-HMAC-SHA256 using your AccessKey ID and secret.

## Endpoints

### Creates an application
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/add-samlidentity-provider-certificate` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| X509Certificate | string | no | The content of the X509 certificate in PEM format |

### Associates a policy set with a gateway
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/attach-policy-set-to-gateway` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| PolicySetName | string | no | The name of the policy set. The name must be unique within the current Alibaba Cloud account |
| GatewayArn | string | no | The ARN of the target gateway |
| EnforcementMode | string | no | The policy enforcement mode. Valid values: ENFORCE (blocks non-compliant requests and allows compliant requests) and LOG_ONLY (only logs… |
| GatewayType | string | no | The gateway type. Valid values: AIGateway: Alibaba Cloud AI gateway. AgentRunMCP: AgentRun MCP tool. Default value: AIGateway |

### Creates an API key credential provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/create-apikey-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| APIKeyCredentialProviderName | string | no | The name of the credential provider |
| Description | string | no | The description of the credential provider |
| APIKey | string | no | The API key value to be securely stored |
| TokenVaultName | string | no | The name of the TokenVault |

### Creates a WorkloadIdentity
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/create-client-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| ClientName | string | no | The name of the client. Specify either this parameter or ClientId |
| ClientId | string | no | The ID of the client. If you specify ClientId, you do not need to specify UserPoolName. Specify either this parameter or ClientName. If… |

### Creates an identity provider to configure the scope of users who can access AI agents
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/create-identity-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| DiscoveryURL | string | no | The metadata URL used to obtain the OpenID configuration or authorization server metadata |
| AllowedAudience | string | no | The list of allowed audiences. A token is allowed if its aud claim matches any audience in the list (JSON-encoded) |
| Description | string | no | The description |
| IdentityProviderName | string | no | The name of the identity provider |

### Creates an OAuth 2.0 credential provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/create-oauth2-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| OAuth2CredentialProviderName | string | no | The name of the credential provider |
| Description | string | no | The description of the OAuth 2.0 credential provider |
| CredentialProviderVendor | string | no | The vendor of the provider, such as AliyunOAuth2, AlibabaCloudOAuth2, DingTalkOAuth2, FeiShuOAuth2, or CustomOAuth2 |
| OAuth2ProviderConfig | string | no | The object that contains provider-specific configurations, such as clientId and clientSecret (JSON-encoded) |
| CallbackURL | string | no | The unique callback URL assigned to the provider. You must configure this URL in the list of allowed callback URLs of the identity… |
| TokenVaultName | string | no | The name of the token vault |
| OAuthType | string | no | The OAuthType |

### Creates an access policy
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/create-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| PolicySetName | string | no | The name of the policy set. The name must be unique within the current Alibaba Cloud account |
| Description | string | no | The description |
| Definition | string | no | The policy definition (JSON-encoded) |
| PolicyName | string | no | The name of the policy. The name must be unique within the associated policy set |

### Creates an access policy set
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/create-policy-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| PolicySetName | string | no | The name of the policy set. The name must be unique within the current Alibaba Cloud account |
| Description | string | no | The description |
| SourcePlatform | string | no | The source platform |

### Creates a role
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/create-role` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| Description | string | no | The description of the role. The description must be 0 to 128 characters in length |
| UserPoolName | string | no | The name of the user pool |
| RoleName | string | no | The name of the role. The name must be unique within the user pool and must be 3 to 64 characters in length |

### Associates a policy set with a gateway
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/create-role-assignment` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| RoleName | string | no | The name of the role to assign |
| PrincipalName | string | no | The name of the principal. If PrincipalType is set to User, specify the username |
| PrincipalType | string | no | The type of the principal. Valid values: User: user. Only this value is supported |
| UserPoolName | string | no | The name of the user pool |

### Creates a token vault
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/create-token-vault` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| TokenVaultName | string | no | The name of the token vault. The name must be unique within the current Alibaba Cloud account |
| Description | string | no | The description |
| RoleArn | string | no | The ARN of the Resource Access Management (RAM) role used to authorize the AgentIdentity service to access other cloud resources such as KMS |
| EncryptionConfig | string | no | The encryption configuration of the token vault. The value is a JSON string (JSON-encoded) |

### Creates a user in a user pool
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/create-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| UserName | string | no | The username. It can contain letters, digits, underscores (_), periods (.), and hyphens (-), and must be 3 to 128 characters in length |
| DisplayName | string | no | The display name of the user. It must be 0 to 128 characters in length |
| Description | string | no | The description of the user. It must be 0 to 256 characters in length |
| Email | string | no | The email address of the user |
| Status | string | no | The status of the user. Valid values: Enabled: Enabled. Disabled: Disabled |

### Creates a user pool
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/create-user-pool` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| Description | string | no | The description of the user pool. The description can be 0 to 128 characters in length |
| UserPoolName | string | no | The name of the user pool. The name must be unique within the same Alibaba Cloud account and must be 3 to 64 characters in length |
| CreateDefaultIdentityProvider | string | no | Specifies whether to create the default identity provider |

### Creates a workload identity
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/create-user-pool-client` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| ClientName | string | no | The name of the client. The name must be unique within the same user pool and be 1 to 64 characters in length |
| RedirectURIs | string | no | The list of OAuth redirect URIs. After authorization is complete, the user's browser is redirected to one of the URIs in the list… |
| SecretRequired | string | no | Specifies whether an application secret is required. Valid values: true: Required. This applies to confidential clients such as… |
| EnforcePKCE | string | no | Specifies whether to enforce Proof Key for Code Exchange (PKCE). Valid values: true: Enforced. The code_challenge parameter is required in… |
| AccessTokenValidity | string | no | The validity period of the access token, in seconds. Valid values: 900 to 10800. Default value: 3600 |
| RefreshTokenValidity | string | no | The validity period of the refresh token, in seconds. Valid values: 7200 to 31536000 (90 days). Default value: 2592000 (30 days) |
| Scopes | string | no | The scopes granted to the application. You can specify multiple scopes (JSON-encoded) |

### Creates a workload identity for an AI agent to uniquely identify the AI agent
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/create-workload-identity` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| WorkloadIdentityName | string | no | The unique name of the workload identity |
| RoleArn | string | no | The ARN of the RAM role |
| AllowedResourceOAuth2ReturnURLs | string | no | The list of allowed OAuth2 return URLs (JSON-encoded) |
| Description | string | no | The description |
| IdentityProviderName | string | no | The configured identity provider |
| SourcePlatform | string | no | The source platform |
| SourceAgentArn | string | no | The ARN of the source agent |
| SessionBindingEnabled | string | no | Specifies whether to enable session binding. If enabled, each session is bound to a specific workload identity instance |
| CreateRAMRole | string | no | Specifies whether the automatic creation of an associated RAM role is enabled. When the Settings value is true, the system performs… |
| AllowedConsentCallbackURLs | string | no | The whitelist of consent authorization callback URLs for the workload identity, which restricts the allowed callback addresses in the… |
| IdentityProviders | string | no | The list of configured identity providers and their corresponding inbound access validation rules, provided as a JSON string |

### Deletes a specified API key credential provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-apikey-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| APIKeyCredentialProviderName | string | no | The name of the credential provider |
| TokenVaultName | string | no | The TokenVault name |

### Deletes an identity provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-client-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| ClientName | string | no | The name of the client. Specify either this parameter or ClientId |
| ClientSecretId | string | no | The key ID of the client secret to delete |
| ClientId | string | no | The ID of the client. Specify either this parameter or ClientName. If both are specified, ClientId takes precedence |

### Deletes a specified identity provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-identity-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| IdentityProviderName | string | no | The name of the identity provider |

### Deletes a specified OAuth 2.0 credential provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-oauth2-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| OAuth2CredentialProviderName | string | no | The name of the credential provider |
| TokenVaultName | string | no | The name of the TokenVault |

### Deletes an access policy
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| PolicySetName | string | no | The name of the policy set. The name must be unique within the current Alibaba Cloud account |
| PolicyName | string | no | The name of the policy. The name must be unique within the policy set to which it belongs |

### Deletes an access policy set
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-policy-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| PolicySetName | string | no | The name of the policy set. The name must be unique within the current Alibaba Cloud account |

### Deletes a role
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-role` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| RoleName | string | no | The name of the role to delete |

### Disassociates a policy set from a gateway
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-role-assignment` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| RoleName | string | no | The name of the role to remove |
| PrincipalType | string | no | The identity type. Only User is supported |
| PrincipalName | string | no | The name of the identity. If PrincipalType is User, specify the username |

### Deletes a WorkloadIdentity
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-samlidentity-provider-certificate` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| CertificateId | string | no | The ID of the certificate to delete |

### Deletes a specified token vault
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-token-vault` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| TokenVaultName | string | no | The name of the token vault. The name must be unique within the current Alibaba Cloud account |

### Deletes a user
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| UserName | string | no | The username of the user to delete |

### Deletes a user pool
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-user-pool` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool to delete |

### Deletes a WorkloadIdentity
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-user-pool-client` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| ClientName | string | no | The name of the client to delete |

### Deletes a specified workload identity
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/delete-workload-identity` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| WorkloadIdentityName | string | no | The unique name of the workload identity |

### Dissociates a policy set from a gateway
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/detach-policy-set-from-gateway` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| PolicySetName | string | no | The name of the policy set. The name must be unique within the current Alibaba Cloud account |
| GatewayArn | string | no | The ARN of the target gateway |
| GatewayType | string | no | The gateway type. Valid values: AIGateway: Alibaba Cloud AI Gateway. AgentRunMCP: AgentRun MCP tool. Default value: AIGateway |

### Retrieves the details of a specified API key credential provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-apikey-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| APIKeyCredentialProviderName | string | no | The name of the credential provider to retrieve |
| TokenVaultName | string | no | The name of the TokenVault |

### Queries the policy configuration of a gateway
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-gateway-policy-config` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| GatewayArn | string | no | The ARN of the target gateway |
| GatewayType | string | no | The gateway type. Valid values: AIGateway: Alibaba Cloud AI gateway. AgentRunMCP: AgentRun MCP tool. Default value: AIGateway |

### Queries the configuration of a specified identity provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-identity-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| IdentityProviderName | string | no | The name of the identity provider |
| UserPoolId | string | no | The ID of the user pool |

### Queries the synchronization scope, validity of selected departments, and scope statistics of the configured…
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-identity-provider-sync-scope` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool. The name must be 3 to 64 characters in length, start with a letter or a digit, and contain only letters,… |
| IdentityProviderType | string | no | The type of the identity provider. This parameter is case-sensitive. DingTalk indicates DingTalk, and Feishu indicates Lark |

### Retrieves the logon-related configurations of a user pool
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-login-preference` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |

### Retrieves the details of a specified OAuth 2.0 credential provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-oauth2-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| OAuth2CredentialProviderName | string | no | The name of the credential provider |
| TokenVaultName | string | no | The name of the TokenVault |

### Queries an access policy
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| PolicySetName | string | no | The name of the policy set. The name must be unique within the current Alibaba Cloud account |
| PolicyName | string | no | The name of the policy. The name must be unique within the associated policy set |

### Queries an access policy set
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-policy-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| PolicySetName | string | no | The name of the policy set. The name must be unique within the current Alibaba Cloud account |

### Retrieves a role
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-role` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| RoleName | string | no | The name of the role |

### Creates an application
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-samlidentity-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |

### Creates an application
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-samlservice-provider-info` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |

### Retrieves a specified identity provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-specific-identity-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| IdentityProviderType | string | no | The type of the identity provider. Currently, only DingTalk is supported |

### Retrieves the detailed configuration of a specified token vault
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-token-vault` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| TokenVaultName | string | no | The name of the token vault. The name must be unique within the current Alibaba Cloud account |

### Retrieves a user
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| UserName | string | no | The username |
| UserPoolId | string | no | The UserPoolId |
| UserId | string | no | The UserId |

### Retrieves a user pool
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-user-pool` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |

### Creates an application
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-user-pool-client` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| ClientName | string | no | The name of the client |

### Retrieves the information about a synchronization job in a user pool
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-user-pool-sync-job` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| SynchronizationJobId | string | no | The ID of the synchronization job |

### Queries the detailed configuration of a workload identity by its name
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/get-workload-identity` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| WorkloadIdentityName | string | no | The unique name of the workload identity |

### Lists all API key credential providers in the account
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-apikey-credential-providers` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| NextToken | string | no | The pagination token used to retrieve the next page of results. Leave this parameter empty for the first request. For subsequent requests,… |
| MaxResults | integer | no | The maximum number of results to return per page |
| TokenVaultName | string | no | The TokenVaultName |

### Lists identity providers
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-client-secrets` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| ClientName | string | no | The client name |
| UserPoolName | string | no | The user pool name |

### Queries a paginated list of direct child departments of a configured DingTalk or Lark identity source in a…
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-identity-provider-departments` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool. The name must be 3 to 64 characters in length and start with a letter or a digit. The remaining characters can… |
| IdentityProviderType | string | no | The type of the identity source. This parameter is case-sensitive. Valid values: DingTalk: DingTalk. Feishu: Lark |
| ParentDepartmentId | string | no | The identifier of the parent department. If this parameter is not specified or is an empty string, DingTalk uses the string 1 for the root… |
| MaxResults | integer | no | The maximum number of departments to return per page. Valid values: 1 to 50. If this parameter is not specified in the first request, the… |
| NextToken | string | no | The pagination token. Do not specify this parameter in the first request. For subsequent requests, use the NextToken value returned from… |

### Lists identity providers
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-identity-providers` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| MaxResults | integer | no | The maximum number of results to return per page |
| NextToken | string | no | The pagination token used to retrieve the next page of results. Leave this parameter empty for the first request. For subsequent requests,… |

### Lists all OAuth 2.0 credential providers in the account
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-oauth2-credential-providers` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| MaxResults | integer | no | The maximum number of results to return per page |
| NextToken | string | no | The pagination token used to retrieve the next page of results. Leave this parameter empty for the first request. For subsequent requests,… |
| TokenVaultName | string | no | The name of the TokenVault |

### Lists access policy details
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-policies` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| NextToken | string | no | The pagination token. You do not need to specify this parameter for the first call. For subsequent calls, pass the NextToken value… |
| MaxResults | integer | no | The maximum number of entries to return on each page |
| PolicySetName | string | no | The name of the policy set. The name must be unique within the current Alibaba Cloud account |

### Lists gateway policy configurations
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-policy-set-attached-gateways` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| PolicySetName | string | no | The name of the policy set. The name must be unique within the current Alibaba Cloud account |
| MaxResults | integer | no | The maximum number of results to return per page |
| NextToken | string | no | The token used for pagination. You do not need to specify this parameter for the first call. For subsequent calls, pass the NextToken… |
| GatewayType | string | no | The gateway type. Valid values: AIGateway: Alibaba Cloud AI Gateway AgentRunMCP: AgentRun MCP tool Default value: AIGateway |

### Lists access policy sets
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-policy-sets` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| NextToken | string | no | The token used for pagination. You do not need to specify this parameter for the first call. For subsequent calls, pass the NextToken… |
| MaxResults | integer | no | The maximum number of results to return per page |

### Lists gateway policy configurations
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-role-assignments` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The user pool name |
| PrincipalName | string | no | Filters results by principal name. If PrincipalType is set to User, specify the username. This parameter must be specified together with… |
| PrincipalType | string | no | Filters results by principal type. Only User is supported. This parameter must be specified together with PrincipalName |
| RoleName | string | no | Filters results by role name |
| MaxResults | integer | no | The maximum number of entries to return per page. Valid values: 1 to 1000. Default value: 100 |
| NextToken | string | no | The token used to retrieve the next page of results. You do not need to specify this parameter for the first call. If a NextToken is… |

### Lists the roles
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-roles` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| MaxResults | integer | no | The maximum number of entries to return per page. Valid values: 1 to 1000. Default value: 100 |
| NextToken | string | no | The token used to retrieve the next page of results. Do not specify this parameter for the first call. If a NextToken is returned in the… |
| UserPoolName | string | no | The name of the user pool |

### Lists identity providers
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-samlidentity-provider-certificates` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |

### Lists all API key credentials under the account
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-token-vaults` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| MaxResults | integer | no | The maximum number of results to return per page |
| NextToken | string | no | The token used for pagination. You do not need to specify this parameter in the first call. In subsequent calls, pass the NextToken value… |

### Lists identity providers
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-user-pool-clients` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| MaxResults | integer | no | The maximum number of entries to return per page. Valid values: 1 to 1000. Default value: 100 |
| NextToken | string | no | The token used to query the next page of data. You do not need to specify this parameter for the first call. If a NextToken is returned in… |
| UserPoolName | string | no | The name of the user pool |

### Lists the user synchronization tasks in a specified user pool
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-user-pool-sync-jobs` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| MaxResults | integer | no | The maximum number of entries per page. Valid values: 1 to 1000. Default value: 100 |
| NextToken | string | no | The pagination token. Leave this parameter empty for the first request. For subsequent requests, use the NextToken value returned in the… |
| UserPoolName | string | no | The name of the user pool |

### Lists identity providers
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-user-pools` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| MaxResults | integer | no | The maximum number of entries to return per page. Valid values: 1 to 1000. Default value: 100 |
| NextToken | string | no | The token used to query the next page of data. This parameter is not required for the first call. If a NextToken is returned in the result… |

### Lists users
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-users` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| MaxResults | integer | no | The maximum number of entries to return per page. Valid values: 1 to 1000. Default value: 100 |
| NextToken | string | no | The token used to query the next page of data. You do not need to specify this parameter for the first call. If a NextToken is returned in… |
| UserPoolName | string | no | The name of the user pool |

### Lists workload identities
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/list-workload-identities` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| MaxResults | integer | no | The maximum number of results to return per page |
| NextToken | string | no | The pagination token used to retrieve the next page of results. Leave this parameter empty for the first request. For subsequent requests,… |

### Triggers a user synchronization task for a user pool
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/run-user-pool-sync-job` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| IdentityProviderType | string | no | The identity provider type. Currently, only DingTalk is supported |
| UserPoolName | string | no | The name of the user pool |
| MaxSyncUsers | string | no | The maximum number of users to synchronize in a single task |

### Creates a workload identity
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/set-samlidentity-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| SSOStatus | string | no | The enabling status of single sign-on (SSO). Valid values: Enabled: SAML SSO is enabled, and users can log on through an external IdP.… |
| EntityId | string | no | The IdP identifier. This is the EntityID from the SAML metadata of the external IdP |
| LoginURL | string | no | The IdP logon URL. When a user logs on, the browser is redirected to this URL to complete SAML authentication |
| X509Certificates | string | no | The list of X.509 certificates in PEM format. If you specify this parameter, all existing certificates are replaced (JSON-encoded) |
| JITProvisionStatus | string | no | The enabling status of Just-In-Time (JIT) user synchronization and creation. Valid values: Enabled: Enabled. If a user with the same name… |
| JITUpdateStatus | string | no | The enabling status of updating user information through synchronization. Valid values: Enabled: The update is enabled. If a user with the… |
| SAMLBindingType | string | no | The SAML protocol binding type. Valid values: HTTP-Redirect: AuthnRequest is sent by using HTTP redirect. Default value. HTTP-POST:… |

### Configures the SSO settings for a specified type of identity provider in a user pool
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/set-specific-identity-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| IdentityProviderType | string | no | The type of the identity provider. Currently, only DingTalk is supported |
| SSOStatus | string | no | The SSO enabling status. Valid values: Enabled: Enabled. Disabled: Disabled |
| IDPMetadata | string | no | The IdP metadata. When the type is DingTalk, the value is in JSON format and includes fields such as corpId, appKey, appSecret,… |

### Modifies the logon password of a user
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/set-user-password` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserName | string | no | The username |
| UserPoolName | string | no | The name of the user pool |
| Password | string | no | The password of the user. The password must comply with the password policy of the user pool and is mutually exclusive with the… |
| GenerateRandomPassword | string | no | Specifies whether to generate a random password. If this parameter is set to true, the system automatically generates a random password… |

### Updates an existing API key credential provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/update-apikey-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| APIKeyCredentialProviderName | string | no | The name of the credential provider to update |
| APIKey | string | no | The new API key value |
| Description | string | no | The new description of the credential provider |
| TokenVaultName | string | no | The name of the token vault. Default value: default |

### Queries the gateway policy configuration
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/update-gateway-policy-config` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| GatewayArn | string | no | The ARN of the target gateway |
| EnforcementMode | string | no | The policy enforcement mode. Valid values: ENFORCE: Intercepts non-compliant requests and allows compliant requests. LOG_ONLY: Only logs… |
| GatewayType | string | no | The gateway type. Valid values: AIGateway: Alibaba Cloud AI gateway. AgentRunMCP: AgentRun MCP tool. Default value: AIGateway |

### Updates the specified identity provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/update-identity-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| IdentityProviderName | string | no | The name of the identity provider |
| DiscoveryURL | string | no | The metadata URL used to retrieve the OpenID configuration or authorization server metadata |
| AllowedAudience | string | no | The allowed audiences. A token is allowed if its aud claim contains any of the specified audiences (JSON-encoded) |
| Description | string | no | The description |

### Updates the logon configuration of a user pool
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/update-login-preference` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| LoginPreference | string | no | The logon preference configuration object. This object contains the logon configuration fields to be updated (JSON-encoded) |
| AllowedPostLogoutRedirectUris | string | no | The AllowedPostLogoutRedirectUris (JSON-encoded) |

### Updates the configuration of an existing OAuth 2.0 credential provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/update-oauth2-credential-provider` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| CallbackURL | string | no | The unique callback URL assigned to the provider, which must be configured in the list of allowed callback URLs of the identity provider.… |
| OAuth2CredentialProviderName | string | no | The name of the credential provider |
| Description | string | no | The description of the OAuth2 credential provider |
| CredentialProviderVendor | string | no | AliyunOAuth2 |
| OAuth2ProviderConfig | string | no | The object that contains provider-specific configurations, such as clientId and clientSecret (JSON-encoded) |
| TokenVaultName | string | no | The name of the TokenVault |

### Updates an access policy
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/update-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| PolicyName | string | no | The name of the policy. The name must be unique within the policy set to which the policy belongs |
| PolicySetName | string | no | The name of the policy set. The name must be unique within the current Alibaba Cloud account |
| Description | string | no | The description |
| Definition | string | no | The definition of the policy (JSON-encoded) |

### Updates an access policy set
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/update-policy-set` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| PolicySetName | string | no | The name of the policy set. The name must be unique within the current Alibaba Cloud account |
| Description | string | no | The description |

### Updates a role
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/update-role` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| Description | string | no | The new description of the role. The description must be 0 to 128 characters in length |
| RoleName | string | no | The name of the role |

### Updates a token vault
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/update-token-vault` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| TokenVaultName | string | no | The name of the token vault. The name must be unique within the current Alibaba Cloud account |
| Description | string | no | The description |
| RoleArn | string | no | The Alibaba Cloud Resource Name (ARN) of the Resource Access Management (RAM) role used to grant the AgentIdentity service access to other… |

### Updates a user in a user pool
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/update-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| UserName | string | no | The username of the user to update. The username must be 3 to 128 characters in length and can contain letters, digits, underscores (_),… |
| DisplayName | string | no | The display name of the user. The display name must be 0 to 128 characters in length |
| Description | string | no | The description of the user. The description must be 0 to 256 characters in length |
| Email | string | no | The email address of the user |
| Status | string | no | The status of the user. Valid values: Enabled: The user is enabled. Disabled: The user is disabled |

### Updates an identity provider
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/update-user-pool` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| Description | string | no | The new description of the user pool. The value must be 0 to 128 characters in length |

### Creates an application
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/update-user-pool-client` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| UserPoolName | string | no | The name of the user pool |
| ClientName | string | no | The name of the client |
| RedirectURIs | string | no | The new list of OAuth callback URLs. Specifying this parameter replaces all existing callback URLs (JSON-encoded) |
| SecretRequired | string | no | Specifies whether an application secret is required. A value of true indicates a confidential client, and a value of false indicates a… |
| EnforcePKCE | string | no | Specifies whether PKCE is enforced |
| RefreshTokenValidity | string | no | The validity period of the refresh token, in seconds. Valid values: 7200 to 31536000 (90 days). Default value: 2592000 (30 days) |
| AccessTokenValidity | string | no | The validity period of the access token, in seconds. Valid values: 900 to 10800. Default value: 3600 |
| Scopes | string | no | The scopes granted to the application. You can specify multiple scopes (JSON-encoded) |

### Updates the specified workload identity
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/update-workload-identity` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |
| WorkloadIdentityName | string | no | The unique name of the workload identity |
| RoleArn | string | no | The ARN of the RAM role |
| AllowedResourceOAuth2ReturnURLs | string | no | The list of allowed OAuth2 return URLs (JSON-encoded) |
| Description | string | no | The description |
| IdentityProviderName | string | no | The configured identity provider |
| SessionBindingEnabled | string | no | Specifies whether session binding is enabled. If enabled, each session is bound to a specific workload identity instance |
| AllowedConsentCallbackURLs | string | no | The whitelist of consent authorization callback URLs for the workload identity, which restricts the allowed callback addresses in the… |
| IdentityProviders | string | no | The list of configured identity providers and their corresponding inbound access validation rules, provided as a JSON string |

### version
`POST https://apizie.tech/v1/cloud:aliyun-agentidentity/version` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://agentidentity.ap-southeast-1.aliyuncs.com |

## Example
```
curl "https://apizie.tech/v1/cloud:aliyun-agentidentity/add-samlidentity-provider-certificate" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Alibaba Cloud Agent Identity API?
Create a free Apizie key, then send POST https://apizie.tech/v1/cloud:aliyun-agentidentity/add-samlidentity-provider-certificate with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Alibaba Cloud Agent Identity API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Alibaba Cloud Agent Identity itself also needs your own key from aliyuncs.com.

### Can AI agents use the Alibaba Cloud Agent Identity API?
Yes. Add the Apizie MCP server (https://apizie.tech/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:aliyun-agentidentity.

### What is the status of the Alibaba Cloud Agent Identity API?
Needs your own provider key (bring your own key)