Reference: API operations by account

This page lists all AWS Organizations API operations, grouped by which account can call them. Choose any API operation to learn more about using it.

From master account

These operations can be called only from the organization's master account.

• AttachPolicy

• CreateAccount

• CreateGovCloudAccount (only under specific conditions)

• CreateOrganization

• CreateOrganizationalUnit

• CreatePolicy

• DeleteOrganization

• DeleteOrganizationalUnit

• DeletePolicy

• DeregisterDelegatedAdministrator

• DescribeAccount

• DescribeCreateAccountStatus

• DescribeOrganizationalUnit

• DescribePolicy

• DetachPolicy

• DisableAWSServiceAccess

• DisablePolicyType

• EnableAllFeatures

• EnableAWSServiceAccess

• EnablePolicyType

• InviteAccountToOrganization

• LeaveOrganization

• ListAccounts

• ListAccountsForParent

• ListAWSServiceAccessForOrganization

• ListChildren

• ListCreateAccountStatus

• ListDelegatedAdministrators

• ListDelegatedServicesForAccount

• ListHandshakesForOrganization

• ListOrganizationalUnitsForParent

• ListParents

• ListPolicies

• ListPoliciesForTarget

• ListRoots

• ListTagsForResource

• ListTargetsForPolicy

• MoveAccount

• RegisterDelegatedAdministrator

• RemoveAccountFromOrganization

• TagResource

• UntagResource

• UpdateOrganizationalUnit

• UpdatePolicy

From any account

These operations can be called from any account in the organization.

• DescribeEffectivePolicy

• DescribeHandshake

• DescribeOrganization

• ListHandshakesForAccount

From accounts under specific conditions

These operations can be called under specific conditions.

• AcceptHandshake

• CancelHandshake

• DeclineHandshake