AWS IAM Identity Center

Manage the workforce directory of AWS IAM Identity Center: create, update and delete users and groups, manage group membership, look people up by user name or email, and read the Identity Center instance.

Actions

Action	What it does
Add user to group	Add a user to a group.
Check user in groups	Check which of up to 100 groups a user belongs to.
Create group	Create a group in the Identity Center directory.
Create user	Add a user to the Identity Center directory.
Delete group	Permanently delete a group.
Delete user	Permanently delete a user and their group memberships.
Describe instance	Read an Identity Center instance's status, encryption and whether multi-account permissions are on.
Find group ID	Find a group's ID from its name or external ID.
Find user ID	Find a user's ID from their user name, email or external ID.
Get group	Read one group's name and description.
Get group membership	Check whether a user is in a group and get the membership ID.
Get user	Read one user's profile.
List group members	List one page of a group's memberships.
List groups	List one page of the groups in the identity store.
List instances	List the IAM Identity Center instances in the connection's region, with each one's identity store ID and status.
List user's groups	List one page of the groups a user belongs to.
List users	List one page of the users in the identity store.
Remove user from group	Remove a user from a group, by membership ID or by group and user.
Update group	Rename a group, or change or remove its description.
Update user	Change a user's attributes.

Add user to group

Add a user to a group. If they are already a member, the existing membership is returned instead of an error.

Inputs

Group IDgroup_idtextRequired: The group's ID, from Create group, List groups or Find group ID. A URL copied from the group's page in the console works too.
User IDuser_idtextRequired: The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.

Outputs

resultobject

Example output

{
  "result": {
    "already_member": false,
    "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
    "membership_id": "9067abcdef-c3d4e5f6-7890-12ab-cdef-333344445555",
    "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
  }
}

Check user in groups

Check which of up to 100 groups a user belongs to.

Inputs

User IDuser_idtextRequired: The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.
Group IDsgroup_idslistRequired: The groups to check, up to 100.

Outputs

resultobject

Example output

{
  "result": {
    "member_of_all": true,
    "member_of_any": true,
    "results": [
      {
        "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
        "is_member": true,
        "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
      }
    ]
  }
}

Create group

Create a group in the Identity Center directory. Group names must be unique.

Inputs

Group namedisplay_nametextRequired: The group's name, e.g. 'Engineering'.
Descriptiondescriptiontext: What the group is for.

Outputs

resultobject

Example output

{
  "result": {
    "display_name": "Engineering",
    "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
    "identity_store_id": "d-9067abcdef"
  }
}

Create user

Add a user to the Identity Center directory. Works only when the identity source is the Identity Center directory, not an external identity provider or Active Directory.

Inputs

User nameuser_nametextRequired: The sign-in name, unique in the directory and without spaces, for example 'jane.doe'.
Display namedisplay_nametextRequired: The full name shown in the console, e.g. 'Jane Doe'.
First namegiven_nametextRequired: The user's first name.
Last namefamily_nametextRequired: The user's last name.
Emailemailtext: The user's email address. Must be unique in the directory.
Email typeemail_typetext: Which kind of address this is. Defaults to Work.One of: work, home, other. Default: work.
Phonephone_numbertext: A phone number.
Phone typephone_typetext: Which kind of number this is. Defaults to Work.One of: work, mobile, home, fax, pager, other. Default: work.
Job titletitletext: Job title.
Nicknamenick_nametext: A casual name.
User typeuser_typetext: Your own classification, e.g. 'Employee' or 'Contractor'.
Preferred languagepreferred_languagetext: Preferred language, e.g. 'en-US'.
Localelocaletext: Locale, e.g. 'en-US'.
Time zonetimezonetext: Time zone, e.g. 'America/New_York'.
Birth datebirthdatedate: The user's date of birth.
Enterprise attributesenterprise_attributesobject: Optional employeeNumber, costCenter, organization, division, department and manager (a user ID).

Outputs

resultobject

Example output

{
  "result": {
    "identity_store_id": "d-9067abcdef",
    "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333",
    "user_name": "jane.doe"
  }
}

Delete group

Permanently delete a group. Its members keep their accounts. This cannot be undone.

Inputs

Group IDgroup_idtextRequired: The group's ID, from Create group, List groups or Find group ID. A URL copied from the group's page in the console works too.

Outputs

resultobject

Example output

{
  "result": {
    "deleted": true,
    "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444"
  }
}

Delete user

Permanently delete a user and their group memberships. This cannot be undone.

Inputs

User IDuser_idtextRequired: The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.

Outputs

resultobject

Example output

{
  "result": {
    "deleted": true,
    "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
  }
}

Describe instance

Read an Identity Center instance's status, encryption and whether multi-account permissions are on.

Inputs

Instanceinstance_arntext: The instance to describe. Leave empty to use the region's only instance.

Outputs

resultobject

Example output

{
  "result": {
    "instance": {
      "created_at": "2026-09-10T00:26:40Z",
      "encryption": null,
      "identity_store_id": "d-9067abcdef",
      "instance_arn": "arn:aws:sso:::instance/ssoins-72231a2b3c4d5e6f",
      "name": "My instance",
      "owner_account_id": "111122223333",
      "permission_sets_enabled": null,
      "primary_region": "us-east-1",
      "regions": [
        {
          "added_at": "2026-09-10T00:26:40Z",
          "is_primary_region": true,
          "region_name": "us-east-1",
          "status": "ACTIVE"
        }
      ],
      "status": "ACTIVE",
      "status_reason": null
    }
  }
}

Find group ID

Find a group's ID from its name or external ID. Returns found = false rather than failing when nothing matches.

Inputs

Look up bylookup_bytextRequired: Which attribute the value below is.One of: displayName (Group name), externalId (External ID (from your identity provider)). Default: displayName.
ValuevaluetextRequired: The group name or external ID. Matching is exact.
External ID issuerexternal_id_issuertext: Only for External ID: the issuer your identity provider set on the group.

Outputs

resultobject

Example output

{
  "result": {
    "found": true,
    "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444"
  }
}

Find user ID

Find a user's ID from their user name, email or external ID. Returns found = false rather than failing when nobody matches.

Inputs

Look up bylookup_bytextRequired: Which attribute the value below is.One of: userName (User name), emails.value (Email), externalId (External ID (from your identity provider)). Default: userName.
ValuevaluetextRequired: The user name, email address or external ID to find. Matching is exact.
External ID issuerexternal_id_issuertext: Only for External ID: the issuer your identity provider set on the user.

Outputs

resultobject

Example output

{
  "result": {
    "found": true,
    "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
  }
}

Get group

Read one group's name and description.

Inputs

Group IDgroup_idtextRequired: The group's ID, from Create group, List groups or Find group ID. A URL copied from the group's page in the console works too.

Outputs

resultobject

Example output

{
  "result": {
    "group": {
      "created_at": "2026-09-10T00:26:40Z",
      "created_by": null,
      "description": "Everyone in engineering",
      "display_name": "Engineering",
      "external_ids": [],
      "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
      "identity_store_id": "d-9067abcdef",
      "updated_at": "2026-09-10T00:26:40Z",
      "updated_by": null
    }
  }
}

Get group membership

Check whether a user is in a group and get the membership ID. Returns is_member = false rather than failing when they are not.

Inputs

Group IDgroup_idtextRequired: The group's ID, from Create group, List groups or Find group ID. A URL copied from the group's page in the console works too.
User IDuser_idtextRequired: The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.

Outputs

resultobject

Example output

{
  "result": {
    "is_member": true,
    "membership_id": "9067abcdef-c3d4e5f6-7890-12ab-cdef-333344445555"
  }
}

Get user

Read one user's profile.

Inputs

User IDuser_idtextRequired: The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.
Include enterprise attributesinclude_enterprise_attributestrue/false: Also return department, employee number, cost center and manager.Default: false.

Outputs

resultobject

Example output

{
  "result": {
    "user": {
      "address": null,
      "birthdate": null,
      "created_at": "2026-09-10T00:26:40Z",
      "created_by": null,
      "display_name": "Jane Doe",
      "email": "jane.doe@example.com",
      "email_type": "work",
      "enterprise": null,
      "external_ids": [],
      "family_name": "Doe",
      "formatted_name": null,
      "given_name": "Jane",
      "honorific_prefix": null,
      "honorific_suffix": null,
      "identity_store_id": "d-9067abcdef",
      "locale": null,
      "middle_name": null,
      "nick_name": null,
      "phone_number": null,
      "phone_type": null,
      "photo_urls": [],
      "preferred_language": null,
      "profile_url": null,
      "role": null,
      "status": "ENABLED",
      "timezone": null,
      "title": "Engineer",
      "updated_at": "2026-09-10T00:26:40Z",
      "updated_by": null,
      "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333",
      "user_name": "jane.doe",
      "user_type": null,
      "website": null
    }
  }
}

List group members

List one page of a group's memberships.

Inputs

Group IDgroup_idtextRequired: The group's ID, from Create group, List groups or Find group ID. A URL copied from the group's page in the console works too.
Page sizemax_resultsnumber: How many records to return (1-100).From 1 to 100.
Next page tokennext_tokentext: The next_token from the previous page. Leave empty for page one.

Outputs

resultobject

Example output

{
  "result": {
    "count": 1,
    "has_more": false,
    "memberships": [
      {
        "created_at": "2026-09-10T00:26:40Z",
        "created_by": null,
        "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
        "identity_store_id": "d-9067abcdef",
        "membership_id": "9067abcdef-c3d4e5f6-7890-12ab-cdef-333344445555",
        "updated_at": null,
        "updated_by": null,
        "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
      }
    ],
    "next_token": null
  }
}

List groups

List one page of the groups in the identity store.

Inputs

Page sizemax_resultsnumber: How many records to return (1-100).From 1 to 100.
Next page tokennext_tokentext: The next_token from the previous page. Leave empty for page one.

Outputs

resultobject

Example output

{
  "result": {
    "count": 1,
    "groups": [
      {
        "created_at": "2026-09-10T00:26:40Z",
        "created_by": null,
        "description": "Everyone in engineering",
        "display_name": "Engineering",
        "external_ids": [],
        "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
        "identity_store_id": "d-9067abcdef",
        "updated_at": "2026-09-10T00:26:40Z",
        "updated_by": null
      }
    ],
    "has_more": false,
    "next_token": null
  }
}

List instances

List the IAM Identity Center instances in the connection's region, with each one's identity store ID and status.

Inputs

Page sizemax_resultsnumber: How many records to return (1-100).From 1 to 100.
Next page tokennext_tokentext: The next_token from the previous page. Leave empty for page one.

Outputs

resultobject

Example output

{
  "result": {
    "count": 1,
    "has_more": false,
    "instances": [
      {
        "created_at": "2026-09-10T00:26:40Z",
        "encryption": null,
        "identity_store_id": "d-9067abcdef",
        "instance_arn": "arn:aws:sso:::instance/ssoins-72231a2b3c4d5e6f",
        "name": "My instance",
        "owner_account_id": "111122223333",
        "permission_sets_enabled": null,
        "primary_region": "us-east-1",
        "regions": [
          {
            "added_at": "2026-09-10T00:26:40Z",
            "is_primary_region": true,
            "region_name": "us-east-1",
            "status": "ACTIVE"
          }
        ],
        "status": "ACTIVE",
        "status_reason": null
      }
    ],
    "next_token": null
  }
}

List user's groups

List one page of the groups a user belongs to.

Inputs

User IDuser_idtextRequired: The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.
Page sizemax_resultsnumber: How many records to return (1-100).From 1 to 100.
Next page tokennext_tokentext: The next_token from the previous page. Leave empty for page one.

Outputs

resultobject

Example output

{
  "result": {
    "count": 1,
    "has_more": false,
    "memberships": [
      {
        "created_at": "2026-09-10T00:26:40Z",
        "created_by": null,
        "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
        "identity_store_id": "d-9067abcdef",
        "membership_id": "9067abcdef-c3d4e5f6-7890-12ab-cdef-333344445555",
        "updated_at": null,
        "updated_by": null,
        "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
      }
    ],
    "next_token": null
  }
}

List users

List one page of the users in the identity store.

Inputs

Page sizemax_resultsnumber: How many records to return (1-100).From 1 to 100.
Next page tokennext_tokentext: The next_token from the previous page. Leave empty for page one.
Include enterprise attributesinclude_enterprise_attributestrue/false: Also return department, employee number, cost center and manager.Default: false.

Outputs

resultobject

Example output

{
  "result": {
    "count": 1,
    "has_more": false,
    "next_token": null,
    "users": [
      {
        "address": null,
        "birthdate": null,
        "created_at": "2026-09-10T00:26:40Z",
        "created_by": null,
        "display_name": "Jane Doe",
        "email": "jane.doe@example.com",
        "email_type": "work",
        "enterprise": null,
        "external_ids": [],
        "family_name": "Doe",
        "formatted_name": null,
        "given_name": "Jane",
        "honorific_prefix": null,
        "honorific_suffix": null,
        "identity_store_id": "d-9067abcdef",
        "locale": null,
        "middle_name": null,
        "nick_name": null,
        "phone_number": null,
        "phone_type": null,
        "photo_urls": [],
        "preferred_language": null,
        "profile_url": null,
        "role": null,
        "status": "ENABLED",
        "timezone": null,
        "title": "Engineer",
        "updated_at": "2026-09-10T00:26:40Z",
        "updated_by": null,
        "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333",
        "user_name": "jane.doe",
        "user_type": null,
        "website": null
      }
    ]
  }
}

Remove user from group

Remove a user from a group, by membership ID or by group and user. Removing someone who is not a member changes nothing and returns removed = false.

Inputs

Membership IDmembership_idtext: The membership to remove, from Add user to group or List group members. Or leave empty and give the group and user.
Group IDgroup_idtext: The group, if no membership ID is given.
User IDuser_idtext: The user, if no membership ID is given.

Outputs

resultobject

Example output

{
  "result": {
    "membership_id": "9067abcdef-c3d4e5f6-7890-12ab-cdef-333344445555",
    "removed": true
  }
}

Update group

Rename a group, or change or remove its description.

Inputs

Group IDgroup_idtextRequired: The group's ID, from Create group, List groups or Find group ID. A URL copied from the group's page in the console works too.
Group namedisplay_nametext: New group name.
Descriptiondescriptiontext: New description.
Remove descriptionclear_descriptiontrue/false: Remove the group's description entirely.Default: false.

Outputs

resultobject

Example output

{
  "result": {
    "group_id": "9067abcdef-b2c3d4e5-6789-01ab-cdef-222233334444",
    "updated": true,
    "updated_attributes": [
      "description"
    ]
  }
}

Update user

Change a user's attributes. Only the fields you fill in are changed; everything else is left as it is.

Inputs

User IDuser_idtextRequired: The user's ID, from Create user, List users or Find user ID. A URL copied from the user's page in the Identity Center console works too.
User nameuser_nametext: New sign-in name (no spaces).
Display namedisplay_nametext: New display name.
First namegiven_nametext: New first name.
Last namefamily_nametext: New last name.
Nicknamenick_nametext: New nickname.
Job titletitletext: New job title.
User typeuser_typetext: New user type.
Emailemailtext: New email address.
Email typeemail_typetext: Which kind of address this is. Defaults to Work.One of: work, home, other. Default: work.
Phonephone_numbertext: New phone number.
Phone typephone_typetext: Which kind of number this is. Defaults to Work.One of: work, mobile, home, fax, pager, other. Default: work.
Preferred languagepreferred_languagetext: New preferred language.
Localelocaletext: New locale.
Time zonetimezonetext: New time zone.
Departmentdepartmenttext: New department (an enterprise attribute).
Advanced changesoperationslist: Other attributes to set or remove, as a list of {"attribute_path": ..., "attribute_value": ...}. Leave out attribute_value to remove the attribute.

Outputs

resultobject

Example output

{
  "result": {
    "updated": true,
    "updated_attributes": [
      "title"
    ],
    "user_id": "9067abcdef-a1b2c3d4-5678-90ab-cdef-111122223333"
  }
}

AWS IAM Identity Center

ActionsCopy Anchor Link

Add user to groupCopy Anchor Link

Inputs

Outputs

Check user in groupsCopy Anchor Link

Inputs

Outputs

Create groupCopy Anchor Link

Inputs

Outputs

Create userCopy Anchor Link

Inputs

Outputs

Delete groupCopy Anchor Link

Inputs

Outputs

Delete userCopy Anchor Link

Inputs

Outputs

Describe instanceCopy Anchor Link

Inputs

Outputs

Find group IDCopy Anchor Link

Inputs

Outputs

Find user IDCopy Anchor Link

Inputs

Outputs

Get groupCopy Anchor Link

Inputs

Outputs

Get group membershipCopy Anchor Link

Inputs

Outputs

Get userCopy Anchor Link

Inputs

Outputs

List group membersCopy Anchor Link

Inputs

Outputs

List groupsCopy Anchor Link

Inputs

Outputs

List instancesCopy Anchor Link

Inputs

Outputs

List user's groupsCopy Anchor Link

Inputs

Outputs

List usersCopy Anchor Link

Inputs

Outputs

Remove user from groupCopy Anchor Link

Inputs

Outputs

Update groupCopy Anchor Link

Inputs

Outputs

Update userCopy Anchor Link

Inputs

Outputs

On this page

Actions

Add user to group

Check user in groups

Create group

Create user

Delete group

Delete user

Describe instance

Find group ID

Find user ID

Get group

Get group membership

Get user

List group members

List groups

List instances

List user's groups

List users

Remove user from group

Update group

Update user