Module Smaws_Client_Organizations.Types

Email address for the management account.

ID for the management account.

ID for the handshake of the transfer.

Timestamp when the transfer ends.

Timestamp when the transfer starts.

Account that manages the specified responsibilities for another organization.

Account that allows another account external to its organization to manage the specified responsibilities for the organization.

Status for the transfer.

The type of transfer. Currently, only BILLING is supported.

ID for the transfer.

Name assigned to the transfer.

Amazon Resource Name (ARN) for the transfer.

New name you want to assign to the transfer.

ID for the transfer.

A boolean value that indicates whether the specified policy is an Amazon Web Services managed policy. If true, then you can attach the policy to roots, OUs, or accounts, but you cannot edit it.

The type of policy.

The description of the policy.

The friendly name of the policy.

The regex pattern that is used to validate this parameter is a string of any of the characters in the ASCII character range.

The Amazon Resource Name (ARN) of the policy.

For more information about ARNs in Organizations, see ARN Formats Supported by Organizations in the Amazon Web Services Service Authorization Reference.

The unique identifier (ID) of the policy.

The regex pattern for a policy ID string requires "p-" followed by from 8 to 128 lowercase or uppercase letters, digits, or the underscore character (_).

The text content of the policy.

A structure that contains additional details about the policy.

A structure that contains details about the updated policy, showing the requested changes.

If provided, the new content for the policy. The text must be correctly formatted JSON that complies with the syntax for the policy's type. For more information, see SCP syntax in the Organizations User Guide.

The maximum size of a policy document depends on the policy's type. For more information, see Maximum and minimum values in the Organizations User Guide.

If provided, the new description for the policy.

If provided, the new name for the policy.

The regex pattern that is used to validate this parameter is a string of any of the characters in the ASCII character range.

ID for the policy that you want to update.

The regex pattern for a policy ID string requires "p-" followed by from 8 to 128 lowercase or uppercase letters, digits, or the underscore character (_).

The path in the organization where this OU exists.

The friendly name of this OU.

The regex pattern that is used to validate this parameter is a string of any of the characters in the ASCII character range.

The Amazon Resource Name (ARN) of this OU.

For more information about ARNs in Organizations, see ARN Formats Supported by Organizations in the Amazon Web Services Service Authorization Reference.

The unique identifier (ID) associated with this OU. The ID is unique to the organization only.

The regex pattern for an organizational unit ID string requires "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that contains the OU). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

A structure that contains the details about the specified OU, including its new name.

The new name that you want to assign to the OU.

The regex pattern that is used to validate this parameter is a string of any of the characters in the ASCII character range.

ID for the OU that you want to rename. You can get the ID from the ListOrganizationalUnitsForParent operation.

The regex pattern for an organizational unit ID string requires "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that contains the OU). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

The list of keys for tags to remove from the specified resource.

The ID of the resource to remove a tag from.

You can specify any of the following taggable resources.

• Amazon Web Services account – specify the account ID number.

• Organizational unit – specify the OU ID that begins with ou- and looks similar to:

  ou-{i 1a2b-34uvwxyz} 

• Root – specify the root ID that begins with r- and looks similar to:

  r-{i 1a2b} 

• Policy – specify the policy ID that begins with p- andlooks similar to:

  p-{i 12abcdefg3} 

A ResponsibilityTransfer object. Contains details for a transfer.

Timestamp when the responsibility transfer is to end.

ID for the transfer.

The string value that's associated with the key of the tag. You can set the value of a tag to an empty string, but you can't set the value of a tag to null.

The key identifier, or name, of the tag.

A list of tags to add to the specified resource.

For each tag in the list, you must specify both a tag key and a value. The value can be an empty string, but you can't set it to null.

If any one of the tags is not valid or if you exceed the maximum allowed number of tags for a resource, then the entire request fails.

The ID of the resource to add a tag to.

You can specify any of the following taggable resources.

• Amazon Web Services account – specify the account ID number.

• Organizational unit – specify the OU ID that begins with ou- and looks similar to:

  ou-{i 1a2b-34uvwxyz} 

• Root – specify the root ID that begins with r- and looks similar to:

  r-{i 1a2b} 

• Policy – specify the policy ID that begins with p- andlooks similar to:

  p-{i 12abcdefg3} 

The status of the policy type as it relates to the associated root. To attach a policy of the specified type to a root or to an OU or account in that root, it must be available in the organization and enabled for that root.

The name of the policy type.

The types of policies that are currently enabled for the root and therefore can be attached to the root or to its OUs or accounts.

Even if a policy type is shown as available in the organization, you can separately enable and disable them at the root level by using EnablePolicyType and DisablePolicyType. Use DescribeOrganization to see the availability of the policy types in that organization.

The friendly name of the root.

The regex pattern that is used to validate this parameter is a string of any of the characters in the ASCII character range.

The Amazon Resource Name (ARN) of the root.

For more information about ARNs in Organizations, see ARN Formats Supported by Organizations in the Amazon Web Services Service Authorization Reference.

The unique identifier (ID) for the root. The ID is unique to the organization only.

The regex pattern for a root ID string requires "r-" followed by from 4 to 32 lowercase letters or digits.

The Amazon Resource Name (ARN) of the resource policy.

The unique identifier (ID) of the resource policy.

The policy text of the resource policy.

A structure that contains resource policy ID and Amazon Resource Name (ARN).

ID for the member account that you want to remove from the organization.

The regex pattern for an account ID string requires exactly 12 digits.

The service principal of the Amazon Web Services service for which you want to make the member account a delegated administrator.

The account ID number of the member account in the organization to register as a delegated administrator.

A structure that contains details about the resource policy.

A list of tags that you want to attach to the newly created resource policy. For each tag in the list, you must specify both a tag key and a value. You can set the value to an empty string, but you can't set it to null. For more information about tagging, see Tagging Organizations resources in the Organizations User Guide.

Calls with tags apply to the initial creation of the resource policy, otherwise an exception is thrown. If any one of the tags is not valid or if you exceed the allowed number of tags for the resource policy, then the entire request fails and the resource policy is not created.

If provided, the new content for the resource policy. The text must be correctly formatted JSON that complies with the syntax for the resource policy's type. For more information, see SCP syntax in the Organizations User Guide.

The type of the policy target.

The friendly name of the policy target.

The regex pattern that is used to validate this parameter is a string of any of the characters in the ASCII character range.

The Amazon Resource Name (ARN) of the policy target.

For more information about ARNs in Organizations, see ARN Formats Supported by Organizations in the Amazon Web Services Service Authorization Reference.

The unique identifier (ID) of the policy target.

The regex pattern for a target ID string requires one of the following:

• Root - A string that begins with "r-" followed by from 4 to 32 lowercase letters or digits.
• Account - A string that consists of exactly 12 digits.
• Organizational unit (OU) - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

The type of the parent entity.

The unique identifier (ID) of the parent entity.

The regex pattern for a parent ID string requires one of the following:

• Root - A string that begins with "r-" followed by from 4 to 32 lowercase letters or digits.
• Organizational unit (OU) - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

Do not use. This field is deprecated and doesn't provide complete information about the policies in your organization.

To determine the policies that are enabled and available for use in your organization, use the ListRoots operation instead.

The email address that is associated with the Amazon Web Services account that is designated as the management account for the organization.

The unique identifier (ID) of the management account of an organization.

The regex pattern for an account ID string requires exactly 12 digits.

The Amazon Resource Name (ARN) of the account that is designated as the management account for the organization.

For more information about ARNs in Organizations, see ARN Formats Supported by Organizations in the Amazon Web Services Service Authorization Reference.

Specifies the functionality that currently is available to the organization. If set to "ALL", then all features are enabled and policies can be applied to accounts in the organization. If set to "CONSOLIDATED_BILLING", then only consolidated billing functionality is available. For more information, see Enabling all features in your organization in the Organizations User Guide.

The Amazon Resource Name (ARN) of an organization.

For more information about ARNs in Organizations, see ARN Formats Supported by Organizations in the Amazon Web Services Service Authorization Reference.

The unique identifier (ID) of an organization.

The regex pattern for an organization ID string requires "o-" followed by from 10 to 32 lowercase letters or digits.

ID for the root or organizational unit that you want to move the account to.

The regex pattern for a parent ID string requires one of the following:

• Root - A string that begins with "r-" followed by from 4 to 32 lowercase letters or digits.
• Organizational unit (OU) - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

ID for the root or organizational unit that you want to move the account from.

The regex pattern for a parent ID string requires one of the following:

• Root - A string that begins with "r-" followed by from 4 to 32 lowercase letters or digits.
• Organizational unit (OU) - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

ID for the account that you want to move.

The regex pattern for an account ID string requires exactly 12 digits.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

A list of structures, each of which contains details about one of the entities to which the specified policy is attached.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

ID for the policy whose attachments you want to know.

The regex pattern for a policy ID string requires "p-" followed by from 8 to 128 lowercase or uppercase letters, digits, or the underscore character (_).

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

The tags that are assigned to the resource.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

The ID of the resource with the tags to list.

You can specify any of the following taggable resources.

• Amazon Web Services account – specify the account ID number.

• Organizational unit – specify the OU ID that begins with ou- and looks similar to:

  ou-{i 1a2b-34uvwxyz} 

• Root – specify the root ID that begins with r- and looks similar to:

  r-{i 1a2b} 

• Policy – specify the policy ID that begins with p- andlooks similar to:

  p-{i 12abcdefg3} 

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

A list of roots that are defined in an organization.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

A list of policies that match the filter criteria in the request. The output list doesn't include the policy contents. To see the content for a policy, see DescribePolicy.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

Specifies the type of policy that you want to include in the response. You must specify one of the following values:

• SERVICE_CONTROL_POLICY
• RESOURCE_CONTROL_POLICY
• DECLARATIVE_POLICY_EC2
• BACKUP_POLICY
• TAG_POLICY
• CHATBOT_POLICY
• AISERVICES_OPT_OUT_POLICY
• SECURITYHUB_POLICY
• UPGRADE_ROLLOUT_POLICY
• INSPECTOR_POLICY
• BEDROCK_POLICY
• S3_POLICY
• NETWORK_SECURITY_DIRECTOR_POLICY

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

The list of policies that match the criteria in the request.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

The type of policy that you want to include in the returned list. You must specify one of the following values:

• SERVICE_CONTROL_POLICY
• RESOURCE_CONTROL_POLICY
• DECLARATIVE_POLICY_EC2
• BACKUP_POLICY
• TAG_POLICY
• CHATBOT_POLICY
• AISERVICES_OPT_OUT_POLICY
• SECURITYHUB_POLICY
• UPGRADE_ROLLOUT_POLICY
• INSPECTOR_POLICY
• BEDROCK_POLICY
• S3_POLICY
• NETWORK_SECURITY_DIRECTOR_POLICY

ID for the root, organizational unit, or account whose policies you want to list.

The regex pattern for a target ID string requires one of the following:

• Root - A string that begins with "r-" followed by from 4 to 32 lowercase letters or digits.
• Account - A string that consists of exactly 12 digits.
• Organizational unit (OU) - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

A list of parents for the specified child account or OU.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

ID for the OU or account whose parent containers you want to list. Don't specify a root.

The regex pattern for a child ID string requires one of the following:

• Account - A string that consists of exactly 12 digits.
• Organizational unit (OU) - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that contains the OU). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

An array of ResponsibilityTransfer objects. Contains details for a transfer.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

The type of responsibility. Currently, only BILLING is supported.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

A list of the OUs in the specified root or parent OU.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

ID for the root or OU whose child OUs you want to list.

The regex pattern for a parent ID string requires one of the following:

• Root - A string that begins with "r-" followed by from 4 to 32 lowercase letters or digits.
• Organizational unit (OU) - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

A ResponsibilityTransfers object. Contains details for a transfer.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

ID for the transfer.

The type of responsibility. Currently, only BILLING is supported.

The type of ID for the participant.

ID for the participant: Acccount ID, organization ID, or email address.

The regex pattern for handshake ID string requires "h-" followed by from 8 to 32 lowercase letters or digits.

An array of HandshakeResource objects. When needed, contains additional details for a handshake. For example, the email address for the sender.

The type of information being passed, specifying how the value is to be interpreted by the other party:

• ACCOUNT: ID for an Amazon Web Services account.
• ORGANIZATION: ID for an organization.
• EMAIL: Email address for the recipient.
• OWNER_EMAIL: Email address for the sender.
• OWNER_NAME: Name of the sender.
• NOTES: Additional text included by the sender for the recipient.

Additional information for the handshake. The format of the value string must match the requirements of the specified type.

An array of HandshakeResource objects. When needed, contains additional details for a handshake. For example, the email address for the sender.

The type of handshake:

• INVITE: Handshake sent to a standalone account requesting that it to join the sender's organization.
• ENABLE_ALL_FEATURES: Handshake sent to invited member accounts to enable all features for the organization.
• APPROVE_ALL_FEATURES: Handshake sent to the management account when all invited member accounts have approved to enable all features.
• TRANSFER_RESPONSIBILITY: Handshake sent to another organization's management account requesting that it designate the sender with the specified responsibilities for recipient's organization.

Timestamp when the handshake expires.

Timestamp when the handshake request was made.

Current state for the handshake.

• REQUESTED: Handshake awaiting a response from the recipient.
• OPEN: Handshake sent to multiple recipients and all recipients have responded. The sender can now complete the handshake action.
• CANCELED: Handshake canceled by the sender.
• ACCEPTED: Handshake accepted by the recipient.
• DECLINED: Handshake declined by the recipient.
• EXPIRED: Handshake has expired.

An array of HandshakeParty objects. Contains details for participant in a handshake.

Amazon Resource Name (ARN) for the handshake.

For more information about ARNs in Organizations, see ARN Formats Supported by Organizations in the Amazon Web Services Service Authorization Reference.

ID for the handshake.

The regex pattern for handshake ID string requires "h-" followed by from 8 to 32 lowercase letters or digits.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

An array of Handshakeobjects. Contains details for a handshake.

The parent handshake. Only used for handshake types that are a child of another type.

If you specify ParentHandshakeId, you cannot also specify ActionType.

The regex pattern for handshake ID string requires "h-" followed by from 8 to 32 lowercase letters or digits.

The type of handshake.

If you specify ActionType, you cannot also specify ParentHandshakeId.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

A HandshakeFilter object. Contains the filer used to select the handshakes for an operation.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

An array of Handshakeobjects. Contains details for a handshake.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

A HandshakeFilter object. Contains the filer used to select the handshakes for an operation.

The individual policies inherited and attached to the account which contributed to the validation error.

The path within the effective policy where the validation error occurred.

The error message for the validation error.

The error code for the validation error. For example, ELEMENTS_TOO_MANY.

The EffectivePolicyValidationError object contains details about the validation errors that occurred when generating or enforcing an effective policy, such as which policies contributed to the error and location of the error.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

The time when the latest effective policy was generated for the specified account.

The path in the organization where the specified account exists.

The specified policy type. One of the following values:

• DECLARATIVE_POLICY_EC2
• BACKUP_POLICY
• TAG_POLICY
• CHATBOT_POLICY
• AISERVICES_OPT_OUT_POLICY
• SECURITYHUB_POLICY
• UPGRADE_ROLLOUT_POLICY
• INSPECTOR_POLICY
• BEDROCK_POLICY
• S3_POLICY
• NETWORK_SECURITY_DIRECTOR_POLICY

The ID of the specified account.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

The type of policy that you want information about. You can specify one of the following values:

• DECLARATIVE_POLICY_EC2
• BACKUP_POLICY
• TAG_POLICY
• CHATBOT_POLICY
• AISERVICES_OPT_OUT_POLICY
• SECURITYHUB_POLICY
• UPGRADE_ROLLOUT_POLICY
• INSPECTOR_POLICY
• BEDROCK_POLICY
• S3_POLICY
• NETWORK_SECURITY_DIRECTOR_POLICY

The ID of the account that you want details about. Specifying an organization root or organizational unit (OU) as the target is not supported.

The date that the account became a delegated administrator for this service.

The name of an Amazon Web Services service that can request an operation for the specified service. This is typically in the form of a URL, such as:

 {i servicename}.amazonaws.com

.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

The services for which the account is a delegated administrator.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

The account ID number of a delegated administrator account in the organization.

The date when the account was made a delegated administrator.

The date when the delegated administrator's account became a part of the organization.

The method by which the delegated administrator's account joined the organization.

Each state represents a specific phase in the account lifecycle. Use this information to manage account access, automate workflows, or trigger actions based on account state changes.

For more information about account states and their implications, see Monitor the state of your Amazon Web Services accounts in the Organizations User Guide.

The status of the delegated administrator's account in the organization.

The friendly name of the delegated administrator's account.

The email address that is associated with the delegated administrator's Amazon Web Services account.

The Amazon Resource Name (ARN) of the delegated administrator's account.

The unique identifier (ID) of the delegated administrator's account.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

The list of delegated administrators in your organization.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

Specifies a service principal name. If specified, then the operation lists the delegated administrators only for the specified service.

If you don't specify a service principal, the operation lists all delegated administrators for all services in your organization.

If the request failed, a description of the reason for the failure.

• ACCOUNT_LIMIT_EXCEEDED: The account couldn't be created because you reached the limit on the number of accounts in your organization.
• CONCURRENT_ACCOUNT_MODIFICATION: You already submitted a request with the same information.
• EMAIL_ALREADY_EXISTS: The account could not be created because another Amazon Web Services account with that email address already exists.
• FAILED_BUSINESS_VALIDATION: The Amazon Web Services account that owns your organization failed to receive business license validation.
• GOVCLOUD_ACCOUNT_ALREADY_EXISTS: The account in the Amazon Web Services GovCloud (US) Region could not be created because this Region already includes an account with that email address.
• IDENTITY_INVALID_BUSINESS_VALIDATION: The Amazon Web Services account that owns your organization can't complete business license validation because it doesn't have valid identity data.
• INVALID_ADDRESS: The account could not be created because the address you provided is not valid.
• INVALID_EMAIL: The account could not be created because the email address you provided is not valid.
• INVALID_PAYMENT_INSTRUMENT: The Amazon Web Services account that owns your organization does not have a supported payment method associated with the account. Amazon Web Services does not support cards issued by financial institutions in Russia or Belarus. For more information, see Managing your Amazon Web Services payments.
• INTERNAL_FAILURE: The account could not be created because of an internal failure. Try again later. If the problem persists, contact Amazon Web Services Customer Support.
• MISSING_BUSINESS_VALIDATION: The Amazon Web Services account that owns your organization has not received Business Validation.
• MISSING_PAYMENT_INSTRUMENT: You must configure the management account with a valid payment method, such as a credit card.
• PENDING_BUSINESS_VALIDATION: The Amazon Web Services account that owns your organization is still in the process of completing business license validation.
• UNKNOWN_BUSINESS_VALIDATION: The Amazon Web Services account that owns your organization has an unknown issue with business license validation.

If the account was created successfully, the ID for the new account in the Amazon Web Services GovCloud (US) Region.

If the account was created successfully, the unique identifier (ID) of the new account.

The regex pattern for an account ID string requires exactly 12 digits.

The date and time that the account was created and the request completed.

The date and time that the request was made for the account creation.

The status of the asynchronous request to create an Amazon Web Services account.

The account name given to the account when it was created.

The unique identifier (ID) that references this request. You get this value from the response of the initial CreateAccount request to create the account.

The regex pattern for a create account request ID string requires "car-" followed by from 8 to 32 lowercase letters or digits.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

A list of objects with details about the requests. Certain elements, such as the accountId number, are present in the output only after the account has been successfully created.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

A list of one or more states that you want included in the response. If this parameter isn't present, all requests are included in the response.

The type of this child entity.

The unique identifier (ID) of this child entity.

The regex pattern for a child ID string requires one of the following:

• Account - A string that consists of exactly 12 digits.
• Organizational unit (OU) - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that contains the OU). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

The list of children of the specified parent container.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

Filters the output to include only the specified child type.

The unique identifier (ID) for the parent root or OU whose children you want to list.

The regex pattern for a parent ID string requires one of the following:

• Root - A string that begins with "r-" followed by from 4 to 32 lowercase letters or digits.
• Organizational unit (OU) - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

The date the account became a part of the organization.

The method by which the account joined the organization.

The paths in the organization where the account exists.

Each state represents a specific phase in the account lifecycle. Use this information to manage account access, automate workflows, or trigger actions based on account state changes.

For more information about account states and their implications, see Monitor the state of your Amazon Web Services accounts in the Organizations User Guide.

The status of the account in the organization.

The Status parameter in the Account object will be retired on September 9, 2026. Although both the account State and account Status parameters are currently available in the Organizations APIs (DescribeAccount, ListAccounts, ListAccountsForParent), we recommend that you update your scripts or other code to use the State parameter instead of Status before September 9, 2026.

The friendly name of the account.

The regex pattern that is used to validate this parameter is a string of any of the characters in the ASCII character range.

The email address associated with the Amazon Web Services account.

The regex pattern for this parameter is a string of characters that represents a standard internet email address.

The Amazon Resource Name (ARN) of the account.

For more information about ARNs in Organizations, see ARN Formats Supported by Organizations in the Amazon Web Services Service Authorization Reference.

The unique identifier (ID) of the account.

The regex pattern for an account ID string requires exactly 12 digits.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

The specified policy type. One of the following values:

• DECLARATIVE_POLICY_EC2
• BACKUP_POLICY
• TAG_POLICY
• CHATBOT_POLICY
• AISERVICES_OPT_OUT_POLICY
• SECURITYHUB_POLICY
• UPGRADE_ROLLOUT_POLICY
• INSPECTOR_POLICY
• BEDROCK_POLICY
• S3_POLICY
• NETWORK_SECURITY_DIRECTOR_POLICY

The accounts in the organization which have an invalid effective policy for the specified policy type.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

The type of policy that you want information about. You can specify one of the following values:

• DECLARATIVE_POLICY_EC2
• BACKUP_POLICY
• TAG_POLICY
• CHATBOT_POLICY
• AISERVICES_OPT_OUT_POLICY
• SECURITYHUB_POLICY
• UPGRADE_ROLLOUT_POLICY
• INSPECTOR_POLICY
• BEDROCK_POLICY
• S3_POLICY
• NETWORK_SECURITY_DIRECTOR_POLICY

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

A list of objects in the organization.

The Status parameter in the API response will be retired on September 9, 2026. Although both the account State and account Status parameters are currently available in the Organizations APIs (DescribeAccount, ListAccounts, ListAccountsForParent), we recommend that you update your scripts or other code to use the State parameter instead of Status before September 9, 2026.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

A list of the accounts in the specified root or OU.

The Status parameter in the API response will be retired on September 9, 2026. Although both the account State and account Status parameters are currently available in the Organizations APIs (DescribeAccount, ListAccounts, ListAccountsForParent), we recommend that you update your scripts or other code to use the State parameter instead of Status before September 9, 2026.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

The unique identifier (ID) for the parent root or organization unit (OU) whose accounts you want to list.

The date that the service principal was enabled for integration with Organizations.

The name of the service principal. This is typically in the form of a URL, such as:

 {i servicename}.amazonaws.com

.

If present, indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null.

A list of the service principals for the services that are enabled to integrate with your organization. Each principal is a structure that includes the name and the date that it was enabled for integration with Organizations.

The maximum number of items to return in the response. If more results exist than the specified MaxResults value, a token is included in the response so that you can retrieve the remaining results.

The parameter for receiving additional results if you receive a NextToken response in a previous request. A NextToken response indicates that more output is available. Set this parameter to the value of the previous call's NextToken response to indicate where the output should continue from.

A list of tags that you want to attach to the transfer. For each tag in the list, you must specify both a tag key and a value. You can set the value to an empty string, but you can't set it to null. For more information about tagging, see Tagging Organizations resources in the Organizations User Guide.

Any tags in the request are checked for compliance with any applicable tag policies when the request is made. The request is rejected if the tags in the request don't match the requirements of the policy at that time. Tag policy compliance is not checked again when the invitation is accepted and the tags are actually attached to the transfer. That means that if the tag policy changes between the invitation and the acceptance, then that tags could potentially be non-compliant.

If any one of the tags is not valid or if you exceed the allowed number of tags for a transfer, then the entire request fails and invitations are not sent.

Name you want to assign to the transfer.

Timestamp when the recipient will begin managing the specified responsibilities.

Additional information that you want to include in the invitation.

A HandshakeParty object. Contains details for the account you want to invite. Currently, only ACCOUNT and EMAIL are supported.

The type of responsibility you want to designate to your organization. Currently, only BILLING is supported.

A structure that contains details about the handshake that is created to support this invitation request.

A list of tags that you want to attach to the account when it becomes a member of the organization. For each tag in the list, you must specify both a tag key and a value. You can set the value to an empty string, but you can't set it to null. For more information about tagging, see Tagging Organizations resources in the Organizations User Guide.

Any tags in the request are checked for compliance with any applicable tag policies when the request is made. The request is rejected if the tags in the request don't match the requirements of the policy at that time. Tag policy compliance is not checked again when the invitation is accepted and the tags are actually attached to the account. That means that if the tag policy changes between the invitation and the acceptance, then that tags could potentially be non-compliant.

If any one of the tags is not valid or if you exceed the allowed number of tags for an account, then the entire request fails and invitations are not sent.

Additional information that you want to include in the generated email to the recipient account owner.

The identifier (ID) of the Amazon Web Services account that you want to invite to join your organization. This is a JSON object that contains the following elements:

\{ "Type": "ACCOUNT", "Id": "<{i  {b account id number} }>" \}

If you use the CLI, you can submit this as a single string, similar to the following example:

--target Id=123456789012,Type=ACCOUNT

If you specify "Type": "ACCOUNT", you must provide the Amazon Web Services account ID number as the Id. If you specify "Type": "EMAIL", you must specify the email address that is associated with the account.

--target Id=diego@example.com,Type=EMAIL

A structure that shows the root with the updated list of enabled policy types.

The policy type that you want to enable. You can specify one of the following values:

• SERVICE_CONTROL_POLICY
• RESOURCE_CONTROL_POLICY
• DECLARATIVE_POLICY_EC2
• BACKUP_POLICY
• TAG_POLICY
• CHATBOT_POLICY
• AISERVICES_OPT_OUT_POLICY
• SECURITYHUB_POLICY
• UPGRADE_ROLLOUT_POLICY
• INSPECTOR_POLICY
• BEDROCK_POLICY
• S3_POLICY
• NETWORK_SECURITY_DIRECTOR_POLICY

ID for the root in which you want to enable a policy type. You can get the ID from the ListRoots operation.

The regex pattern for a root ID string requires "r-" followed by from 4 to 32 lowercase letters or digits.

A structure that contains details about the handshake created to support this request to enable all features in the organization.

The service principal name of the Amazon Web Services service for which you want to enable integration with your organization. This is typically in the form of a URL, such as

 {i service-abbreviation}.amazonaws.com

.

The policy type.

The account ID of the policy target.

The time of the last update to this policy.

The text content of the policy.

A structure that shows the root with the updated list of enabled policy types.

The policy type that you want to disable in this root. You can specify one of the following values:

• SERVICE_CONTROL_POLICY
• RESOURCE_CONTROL_POLICY
• DECLARATIVE_POLICY_EC2
• BACKUP_POLICY
• TAG_POLICY
• CHATBOT_POLICY
• AISERVICES_OPT_OUT_POLICY
• SECURITYHUB_POLICY
• UPGRADE_ROLLOUT_POLICY
• INSPECTOR_POLICY
• BEDROCK_POLICY
• S3_POLICY
• NETWORK_SECURITY_DIRECTOR_POLICY

ID for the root in which you want to disable a policy type. You can get the ID from the ListRoots operation.

The regex pattern for a root ID string requires "r-" followed by from 4 to 32 lowercase letters or digits.

The service principal name of the Amazon Web Services service for which you want to disable integration with your organization. This is typically in the form of a URL, such as

 {i service-abbreviation}.amazonaws.com

.

ID for the root, OU, or account that you want to detach the policy from. You can get the ID from the ListRoots, ListOrganizationalUnitsForParent, or ListAccounts operations.

The regex pattern for a target ID string requires one of the following:

• Root - A string that begins with "r-" followed by from 4 to 32 lowercase letters or digits.
• Account - A string that consists of exactly 12 digits.
• Organizational unit (OU) - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

ID for the policy you want to detach. You can get the ID from the ListPolicies or ListPoliciesForTarget operations.

The regex pattern for a policy ID string requires "p-" followed by from 8 to 128 lowercase or uppercase letters, digits, or the underscore character (_).

A ResponsibilityTransfer object. Contains details for a transfer.

ID for the transfer.

A structure that contains details about the resource policy.

A structure that contains details about the specified policy.

ID for the policy that you want details about. You can get the ID from the ListPolicies or ListPoliciesForTarget operations.

The regex pattern for a policy ID string requires "p-" followed by from 8 to 128 lowercase or uppercase letters, digits, or the underscore character (_).

A structure that contains details about the specified OU.

ID for the organizational unit that you want details about. You can get the ID from the ListOrganizationalUnitsForParent operation.

The regex pattern for an organizational unit ID string requires "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that contains the OU). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

A structure that contains information about the organization.

The AvailablePolicyTypes part of the response is deprecated, and you shouldn't use it in your apps. It doesn't include any policy type supported by Organizations other than SCPs. In the China (Ningxia) Region, no policy type is included. To determine which policy types are enabled in your organization, use the

 [ListRoots] 

operation.

A Handshake object. Contains details for the handshake.

ID for the handshake that you want information about.

The regex pattern for handshake ID string requires "h-" followed by from 8 to 32 lowercase letters or digits.

The contents of the effective policy.

When you're signed in as the management account, specify the ID of the account that you want details about. Specifying an organization root or organizational unit (OU) as the target is not supported.

The type of policy that you want information about. You can specify one of the following values:

• DECLARATIVE_POLICY_EC2
• BACKUP_POLICY
• TAG_POLICY
• CHATBOT_POLICY
• AISERVICES_OPT_OUT_POLICY
• SECURITYHUB_POLICY
• UPGRADE_ROLLOUT_POLICY
• INSPECTOR_POLICY
• BEDROCK_POLICY
• S3_POLICY
• NETWORK_SECURITY_DIRECTOR_POLICY

A structure that contains the current status of an account creation request.

Specifies the Id value that uniquely identifies the CreateAccount request. You can get the value from the CreateAccountStatus.Id response in an earlier CreateAccount request, or from the ListCreateAccountStatus operation.

The regex pattern for a create account request ID string requires "car-" followed by from 8 to 32 lowercase letters or digits.

A structure that contains information about the requested account.

The Status parameter in the API response will be retired on September 9, 2026. Although both the account State and account Status parameters are currently available in the Organizations APIs (DescribeAccount, ListAccounts, ListAccountsForParent), we recommend that you update your scripts or other code to use the State parameter instead of Status before September 9, 2026.

The unique identifier (ID) of the Amazon Web Services account that you want information about. You can get the ID from the ListAccounts or ListAccountsForParent operations.

The regex pattern for an account ID string requires exactly 12 digits.

The service principal name of an Amazon Web Services service for which the account is a delegated administrator.

Delegated administrator privileges are revoked for only the specified Amazon Web Services service from the member account. If the specified service is the only service for which the member account is a delegated administrator, the operation also revokes Organizations read action permissions.

The account ID number of the member account in the organization that you want to deregister as a delegated administrator.