request description

The interface request does not need to be signed, it is recommended to use the POST method call, the request header Content-Type is set to application/x-www-form-urlencoded, and the parameters are encoded by the URL and submitted in the form of the request body.

Request address: https://sts.volcengineapi.com
200/s per account

request parameters

Parameters	Type	Required or not	Example Values	Description
RoleTrn	String	Yes	trn:iam::2000012345:role/my_role	The role Trn to be played is in the format of'trn: iam:: ${AccountId}: role/${RoleName} '. Where' ${AccountId} 'needs to fill in the main account ID to which the role belongs, and' ${RoleName} 'needs to fill in the actual role name. For example, the RoleTrn corresponding to the role named myRole in the account with the account ID of 2000012345 is'trn: iam :: 2000012345: role/myRole `
SAMLProviderTrn	String	Yes	trn:iam::2000000001:saml-provider/my_idp	SAML external identity provider TRN. Format'trn: iam:: ${AccountId}: saml-provider/${ProviderName} ' n
SAMLResp	String	Yes	base64_encoded_saml_assertion	Base64 encoded SAML assertion.
Policy	String	No	{"Statement":[{"Effect":"Allow","Action":["iam:GetUser"],"Resource":["*"]}]}	Role internal connection policy to further restrict the permissions of temporary credentials. The length should not exceed 2048 characters. If the internal connection permissions policy is not null, the actual permissions of the temporary credentials are the intersection of the permissions policy of the role played and the internal connection permissions policy. The policy syntax format is the same as that of a normal IAM policy, see Introduction to Policy Syntax (https://www.volcengine.com/docs/6257/65059).
DurationSeconds	Integer	No	3600	Temporary key valid duration (unit: seconds), the shortest can be set to 900 seconds, and the longest can be set to the maximum session duration value of the role (configured in the role information), the default value is 3600 seconds.

return parameters

Parameters	Type	Example Values	Description
SAMLAssertionInfo	Object	Please refer to the specific parameter example value in the data structure.	Partial information in the SAML assertion.
AssumedRoleUser	Object	Please refer to the specific parameter example value in the data structure. n n	Basic information about role-playing.
Credentials	Object	Please refer to the specific parameter example value in the data structure.	Temporary security credentials generated by role play.

Request example

POST /?Action=AssumeRoleWithSAML&Version=2018-01-01 HTTP/1.1 
Host: sts.volcengineapi.com 
Content-Type: application/x-www-form-urlencoded 
User-Agent: curl/7.64.1 

RoleTrn%3Dtrn%3Aiam%3A%3A2000012345%3Arole%2Fmy_role%26SAMLProviderTrn%3Dtrn%3Aiam%3A%3A2000000001%3Asaml-provider%2Fmy_idp%26SAMLResp%3DeIv934JD

Back to example

{ 
  "ResponseMetadata": { 
    "RequestId": "2025063019011211816709818655381C", 
    "Action": "AssumeRoleWithSAML", 
    "Version": "2018-01-01", 
    "Service": "sts", 
    "Region": "cn-beijing" 
  }, 
  "Result": { 
    "SAMLAssertionInfo": { 
      "SubjectType": "xThA", 
      "Subject": "LUYDlf7g", 
      "Issuer": "TRL", 
      "Recipient": "M2" 
    }, 
    "AssumedRoleUser": { 
      "Trn": "trn:sts::2000000001:assumed-role/AdminRole/bob", 
      "AssumedRoleId": "2*********:bob" 
    }, 
    "Credentials": { 
      "CurrentTime": "2021-04-12T10:57:09+08:00", 
      "Expiration": "2021-04-12T11:57:09+08:00", 
      "AccessKeyId": "AKTPODg0MzV**2ZDcxMDg", 
      "SecretAccessKey": "TVRNN*********************Q==", 
      "SessionToken": "IYfYjE0" 
    } 
  } 
}

error code

Status Code	Error Code	Error message	Description
400	SAMLRespSignNotMatch	The SAML response signature does not match.	Invalid signature in SAML Response.
400	MalformedSAMLRespDoc	The SAML response document is malformed.	SAML Response format is invalid.
400	InvalidIssueInstant	The SAML response issue instant is too old or in the future.	Issue Instant in SAML Response is invalid.
400	InvalidSessionName	The SAML session name is invalid.	Invalid Session Name property in SAML Response.
400	InvalidSAMLAssertion	The SAML assertion is invalid.	SAML Response Assertion invalid.
400	RoleNotExist	Role '{{.Role}}' does not exist.	Character does not exist.
403	SigningCertDateInvalid	This SAML signing certificate is not yet valid or has expired.	The SAML signing certificate has expired or is not yet valid.
403	NoPermission	This SAML Response cannot be exchanged for temporary credentials for the target identity TRN.	Target identity in SAML Response does not match parameter.

Last updated: 2025.10.10 11:26:15

IAM

request description #

request parameters #

return parameters #

Request example #