# Amazon Verified Permissions API Reference > Amazon Verified Permissions is a permissions management service from AWS. You can use Verified Permissions to manage permissions for your application, and authorize user access based on those permissions. Using Verified Permissions, application developers can grant access based on information about the users, resources, and requested actions. You can also evaluate additional information like group membership, attributes of the resources, and session context, such as time of request and IP addresses. Verified Permissions manages these permissions by letting you create and store authorization policies for your applications, such as consumer-facing web sites and enterprise business systems. - [Welcome](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/Welcome.md) - [Common Parameters](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/CommonParameters.md) - [Common Error Types](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/CommonErrors.md) ## [Actions](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_Operations.md) - [BatchGetPolicy](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchGetPolicy.md): Retrieves information about a group (batch) of policies. - [BatchIsAuthorized](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorized.md): Makes a series of decisions about multiple authorization requests for one principal or resource. - [BatchIsAuthorizedWithToken](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorizedWithToken.md): Makes a series of decisions about multiple authorization requests for one token. - [CreateIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreateIdentitySource.md): Adds an identity source to a policy store–an Amazon Cognito user pool or OpenID Connect (OIDC) identity provider (IdP). - [CreatePolicy](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreatePolicy.md): Creates a Cedar policy and saves it in the specified policy store. - [CreatePolicyStore](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreatePolicyStore.md): Creates a policy store. - [CreatePolicyStoreAlias](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreatePolicyStoreAlias.md): Creates a policy store alias for the specified policy store. - [CreatePolicyTemplate](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreatePolicyTemplate.md): Creates a policy template. - [DeleteIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_DeleteIdentitySource.md): Deletes an identity source that references an identity provider (IdP) such as Amazon Cognito. - [DeletePolicy](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_DeletePolicy.md): Deletes the specified policy from the policy store. - [DeletePolicyStore](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_DeletePolicyStore.md): Deletes the specified policy store. - [DeletePolicyStoreAlias](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_DeletePolicyStoreAlias.md): Deletes the specified policy store alias. - [DeletePolicyTemplate](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_DeletePolicyTemplate.md): Deletes the specified policy template from the policy store. - [GetIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_GetIdentitySource.md): Retrieves the details about the specified identity source. - [GetPolicy](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_GetPolicy.md): Retrieves information about the specified policy. - [GetPolicyStore](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_GetPolicyStore.md): Retrieves details about a policy store. - [GetPolicyStoreAlias](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_GetPolicyStoreAlias.md): Retrieves details about the specified policy store alias. - [GetPolicyTemplate](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_GetPolicyTemplate.md): Retrieve the details for the specified policy template in the specified policy store. - [GetSchema](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_GetSchema.md): Retrieve the details for the specified schema in the specified policy store. - [IsAuthorized](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorized.md): Makes an authorization decision about a service request described in the parameters. - [IsAuthorizedWithToken](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.md): Makes an authorization decision about a service request described in the parameters. - [ListIdentitySources](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ListIdentitySources.md): Returns a paginated list of all of the identity sources defined in the specified policy store. - [ListPolicies](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ListPolicies.md): Returns a paginated list of all policies stored in the specified policy store. - [ListPolicyStoreAliases](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ListPolicyStoreAliases.md): Returns a paginated list of all policy store aliases in the calling AWS account. - [ListPolicyStores](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ListPolicyStores.md): Returns a paginated list of all policy stores in the calling AWS account. - [ListPolicyTemplates](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ListPolicyTemplates.md): Returns a paginated list of all policy templates in the specified policy store. - [ListTagsForResource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ListTagsForResource.md): Returns the tags associated with the specified Amazon Verified Permissions resource. - [PutSchema](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_PutSchema.md): Creates or updates the policy schema in the specified policy store. - [TagResource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_TagResource.md): Assigns one or more tags (key-value pairs) to the specified Amazon Verified Permissions resource. - [UntagResource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UntagResource.md): Removes one or more tags from the specified Amazon Verified Permissions resource. - [UpdateIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdateIdentitySource.md): Updates the specified identity source to use a new identity provider (IdP), or to change the mapping of identities from the IdP to a different principal entity type. - [UpdatePolicy](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdatePolicy.md): Modifies a Cedar static policy in the specified policy store. - [UpdatePolicyStore](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdatePolicyStore.md): Modifies the validation setting for a policy store. - [UpdatePolicyTemplate](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdatePolicyTemplate.md): Updates the specified policy template. ## [Data Types](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_Types.md) - [ActionIdentifier](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ActionIdentifier.md): Contains information about an action for a request for which an authorization decision is made. - [AttributeValue](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_AttributeValue.md): The value of an attribute. - [BatchGetPolicyErrorItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchGetPolicyErrorItem.md): Contains the information about an error resulting from a BatchGetPolicy API call. - [BatchGetPolicyInputItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchGetPolicyInputItem.md): Information about a policy that you include in a BatchGetPolicy API request. - [BatchGetPolicyOutputItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchGetPolicyOutputItem.md): Contains information about a policy returned from a BatchGetPolicy API request. - [BatchIsAuthorizedInputItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorizedInputItem.md): An authorization request that you include in a BatchIsAuthorized API request. - [BatchIsAuthorizedOutputItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorizedOutputItem.md): The decision, based on policy evaluation, from an individual authorization request in a BatchIsAuthorized API request. - [BatchIsAuthorizedWithTokenInputItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorizedWithTokenInputItem.md): An authorization request that you include in a BatchIsAuthorizedWithToken API request. - [BatchIsAuthorizedWithTokenOutputItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorizedWithTokenOutputItem.md): The decision, based on policy evaluation, from an individual authorization request in a BatchIsAuthorizedWithToken API request. - [CedarTagValue](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CedarTagValue.md): The value of an entity's Cedar tag. - [CognitoGroupConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CognitoGroupConfiguration.md): The type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. - [CognitoGroupConfigurationDetail](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CognitoGroupConfigurationDetail.md): The type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. - [CognitoGroupConfigurationItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CognitoGroupConfigurationItem.md): The type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. - [CognitoUserPoolConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CognitoUserPoolConfiguration.md): The configuration for an identity source that represents a connection to an Amazon Cognito user pool used as an identity provider for Verified Permissions. - [CognitoUserPoolConfigurationDetail](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CognitoUserPoolConfigurationDetail.md): The configuration for an identity source that represents a connection to an Amazon Cognito user pool used as an identity provider for Verified Permissions. - [CognitoUserPoolConfigurationItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CognitoUserPoolConfigurationItem.md): The configuration for an identity source that represents a connection to an Amazon Cognito user pool used as an identity provider for Verified Permissions. - [Configuration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_Configuration.md): Contains configuration information used when creating a new identity source. - [ConfigurationDetail](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ConfigurationDetail.md): Contains configuration information about an identity source. - [ConfigurationItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ConfigurationItem.md): Contains configuration information about an identity source. - [ContextDefinition](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ContextDefinition.md): Contains additional details about the context of the request. - [DeterminingPolicyItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_DeterminingPolicyItem.md): Contains information about one of the policies that determined an authorization decision. - [EncryptionSettings](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_EncryptionSettings.md): A structure that contains the encryption configuration for the policy store and child resources. - [EncryptionState](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_EncryptionState.md): A structure that contains the encryption configuration for the policy store and child resources. - [EntitiesDefinition](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_EntitiesDefinition.md): Contains the list of entities to be considered during an authorization request. - [EntityIdentifier](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_EntityIdentifier.md): Contains the identifier of an entity, including its ID and type. - [EntityItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_EntityItem.md): Contains information about an entity that can be referenced in a Cedar policy. - [EntityReference](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_EntityReference.md): Contains information about a principal or resource that can be referenced in a Cedar policy. - [EvaluationErrorItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_EvaluationErrorItem.md): Contains a description of an evaluation error. - [IdentitySourceDetails](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IdentitySourceDetails.md): This data type has been deprecated. - [IdentitySourceFilter](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IdentitySourceFilter.md): A structure that defines characteristics of an identity source that you can use to filter. - [IdentitySourceItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IdentitySourceItem.md): A structure that defines an identity source. - [IdentitySourceItemDetails](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IdentitySourceItemDetails.md): This data type has been deprecated. - [KmsEncryptionSettings](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_KmsEncryptionSettings.md): A structure that contains the KMS encryption configuration for the policy store. - [KmsEncryptionState](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_KmsEncryptionState.md): A structure that contains the AWS KMS encryption configuration for the policy store. - [OpenIdConnectAccessTokenConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectAccessTokenConfiguration.md): The configuration of an OpenID Connect (OIDC) identity source for handling access token claims. - [OpenIdConnectAccessTokenConfigurationDetail](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectAccessTokenConfigurationDetail.md): The configuration of an OpenID Connect (OIDC) identity source for handling access token claims. - [OpenIdConnectAccessTokenConfigurationItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectAccessTokenConfigurationItem.md): The configuration of an OpenID Connect (OIDC) identity source for handling access token claims. - [OpenIdConnectConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectConfiguration.md): Contains configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. - [OpenIdConnectConfigurationDetail](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectConfigurationDetail.md): Contains configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. - [OpenIdConnectConfigurationItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectConfigurationItem.md): Contains configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. - [OpenIdConnectGroupConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectGroupConfiguration.md): The claim in OIDC identity provider tokens that indicates a user's group membership, and the entity type that you want to map it to. - [OpenIdConnectGroupConfigurationDetail](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectGroupConfigurationDetail.md): The claim in OIDC identity provider tokens that indicates a user's group membership, and the entity type that you want to map it to. - [OpenIdConnectGroupConfigurationItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectGroupConfigurationItem.md): The claim in OIDC identity provider tokens that indicates a user's group membership, and the entity type that you want to map it to. - [OpenIdConnectIdentityTokenConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectIdentityTokenConfiguration.md): The configuration of an OpenID Connect (OIDC) identity source for handling identity (ID) token claims. - [OpenIdConnectIdentityTokenConfigurationDetail](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectIdentityTokenConfigurationDetail.md): The configuration of an OpenID Connect (OIDC) identity source for handling identity (ID) token claims. - [OpenIdConnectIdentityTokenConfigurationItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectIdentityTokenConfigurationItem.md): The configuration of an OpenID Connect (OIDC) identity source for handling identity (ID) token claims. - [OpenIdConnectTokenSelection](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectTokenSelection.md): The token type that you want to process from your OIDC identity provider. - [OpenIdConnectTokenSelectionDetail](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectTokenSelectionDetail.md): The token type that you want to process from your OIDC identity provider. - [OpenIdConnectTokenSelectionItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectTokenSelectionItem.md): The token type that you want to process from your OIDC identity provider. - [PolicyDefinition](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_PolicyDefinition.md): A structure that contains the details for a Cedar policy definition. - [PolicyDefinitionDetail](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_PolicyDefinitionDetail.md): A structure that describes a policy definition. - [PolicyDefinitionItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_PolicyDefinitionItem.md): A structure that describes a PolicyDefinintion. - [PolicyFilter](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_PolicyFilter.md): Contains information about a filter to refine policies returned in a query. - [PolicyItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_PolicyItem.md): Contains information about a policy. - [PolicyStoreAliasFilter](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_PolicyStoreAliasFilter.md): Contains filters for the ListPolicyStoreAliases operation. - [PolicyStoreAliasItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_PolicyStoreAliasItem.md): Contains information about a policy store alias. - [PolicyStoreItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_PolicyStoreItem.md): Contains information about a policy store. - [PolicyTemplateItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_PolicyTemplateItem.md): Contains details about a policy template - [ResourceConflict](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ResourceConflict.md): Contains information about a resource conflict. - [SchemaDefinition](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_SchemaDefinition.md): Contains a list of principal types, resource types, and actions that can be specified in policies stored in the same policy store. - [StaticPolicyDefinition](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_StaticPolicyDefinition.md): Contains information about a static policy. - [StaticPolicyDefinitionDetail](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_StaticPolicyDefinitionDetail.md): A structure that contains details about a static policy. - [StaticPolicyDefinitionItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_StaticPolicyDefinitionItem.md): A structure that contains details about a static policy. - [TemplateLinkedPolicyDefinition](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_TemplateLinkedPolicyDefinition.md): Contains information about a policy created by instantiating a policy template. - [TemplateLinkedPolicyDefinitionDetail](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_TemplateLinkedPolicyDefinitionDetail.md): Contains information about a policy that was created by instantiating a policy template. - [TemplateLinkedPolicyDefinitionItem](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_TemplateLinkedPolicyDefinitionItem.md): Contains information about a policy created by instantiating a policy template. - [UpdateCognitoGroupConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdateCognitoGroupConfiguration.md): The user group entities from an Amazon Cognito user pool identity source. - [UpdateCognitoUserPoolConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdateCognitoUserPoolConfiguration.md): Contains configuration details of a Amazon Cognito user pool for use with an identity source. - [UpdateConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdateConfiguration.md): Contains an update to replace the configuration in an existing identity source. - [UpdateOpenIdConnectAccessTokenConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdateOpenIdConnectAccessTokenConfiguration.md): The configuration of an OpenID Connect (OIDC) identity source for handling access token claims. - [UpdateOpenIdConnectConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdateOpenIdConnectConfiguration.md): Contains configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. - [UpdateOpenIdConnectGroupConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdateOpenIdConnectGroupConfiguration.md): The claim in OIDC identity provider tokens that indicates a user's group membership, and the entity type that you want to map it to. - [UpdateOpenIdConnectIdentityTokenConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdateOpenIdConnectIdentityTokenConfiguration.md): The configuration of an OpenID Connect (OIDC) identity source for handling identity (ID) token claims. - [UpdateOpenIdConnectTokenSelection](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdateOpenIdConnectTokenSelection.md): The token type that you want to process from your OIDC identity provider. - [UpdatePolicyDefinition](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdatePolicyDefinition.md): Contains information about updates to be applied to a policy. - [UpdateStaticPolicyDefinition](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdateStaticPolicyDefinition.md): Contains information about an update to a static policy. - [ValidationExceptionField](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ValidationExceptionField.md): Details about a field that failed policy validation. - [ValidationSettings](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_ValidationSettings.md): A structure that contains Cedar policy validation settings for the policy store. ## Full content The entire guide is also available as a single markdown file, useful for feeding the full guide to an LLM in one pass: - [Complete guide (single file)](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/full.md)