CreateAuthorizerCommand

Suggest an Edit

Adds a new Authorizer resource to an existing RestApi resource.

Example Syntax

Use a bare-bones client and the command you need to make an API call.

import { APIGatewayClient, CreateAuthorizerCommand } from "@aws-sdk/client-api-gateway"; // ES Modules import
// const { APIGatewayClient, CreateAuthorizerCommand } = require("@aws-sdk/client-api-gateway"); // CommonJS import
const client = new APIGatewayClient(config);
const input = { // CreateAuthorizerRequest
  restApiId: "STRING_VALUE", // required
  name: "STRING_VALUE", // required
  type: "TOKEN" || "REQUEST" || "COGNITO_USER_POOLS", // required
  providerARNs: [ // ListOfARNs
    "STRING_VALUE",
  ],
  authType: "STRING_VALUE",
  authorizerUri: "STRING_VALUE",
  authorizerCredentials: "STRING_VALUE",
  identitySource: "STRING_VALUE",
  identityValidationExpression: "STRING_VALUE",
  authorizerResultTtlInSeconds: Number("int"),
};
const command = new CreateAuthorizerCommand(input);
const response = await client.send(command);
// { // Authorizer
//   id: "STRING_VALUE",
//   name: "STRING_VALUE",
//   type: "TOKEN" || "REQUEST" || "COGNITO_USER_POOLS",
//   providerARNs: [ // ListOfARNs
//     "STRING_VALUE",
//   ],
//   authType: "STRING_VALUE",
//   authorizerUri: "STRING_VALUE",
//   authorizerCredentials: "STRING_VALUE",
//   identitySource: "STRING_VALUE",
//   identityValidationExpression: "STRING_VALUE",
//   authorizerResultTtlInSeconds: Number("int"),
// };

CreateAuthorizerCommand Input

See CreateAuthorizerCommandInput for more details

Parameter
Type
Description
name
Required
string | undefined

The name of the authorizer.

restApiId
Required
string | undefined

The string identifier of the associated RestApi.

type
Required
AuthorizerType | undefined

The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.

authType
string | undefined

Optional customer-defined field, used in OpenAPI imports and exports without functional impact.

authorizerCredentials
string | undefined

Specifies the required credentials as an IAM role for API Gateway to invoke the authorizer. To specify an IAM role for API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.

authorizerResultTtlInSeconds
number | undefined

The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.

authorizerUri
string | undefined

Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations. In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api}, where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial /. For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations.

identitySource
string | undefined

The identity source for which authorization is requested. For a TOKEN or COGNITO_USER_POOLS authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth, the header mapping expression is method.request.header.Auth. For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name. These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.

identityValidationExpression
string | undefined

A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. For COGNITO_USER_POOLS authorizers, API Gateway will match the aud field of the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function when there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.

providerARNs
string[] | undefined

A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}. For a TOKEN or REQUEST authorizer, this is not defined.

CreateAuthorizerCommand Output

See CreateAuthorizerCommandOutput for details

Parameter
Type
Description
$metadata
Required
ResponseMetadata
Metadata pertaining to this request.
authType
string | undefined

Optional customer-defined field, used in OpenAPI imports and exports without functional impact.

authorizerCredentials
string | undefined

Specifies the required credentials as an IAM role for API Gateway to invoke the authorizer. To specify an IAM role for API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.

authorizerResultTtlInSeconds
number | undefined

The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.

authorizerUri
string | undefined

Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations. In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api}, where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial /. For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations.

id
string | undefined

The identifier for the authorizer resource.

identitySource
string | undefined

The identity source for which authorization is requested. For a TOKEN or COGNITO_USER_POOLS authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth, the header mapping expression is method.request.header.Auth. For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name. These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.

identityValidationExpression
string | undefined

A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. For COGNITO_USER_POOLS authorizers, API Gateway will match the aud field of the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function when there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.

name
string | undefined

The name of the authorizer.

providerARNs
string[] | undefined

A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}. For a TOKEN or REQUEST authorizer, this is not defined.

type
AuthorizerType | undefined

The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.

Throws

Name
Fault
Details
BadRequestException
client

The submitted request is not valid, for example, the input is incomplete or incorrect. See the accompanying error message for details.

ConflictException
client

The request configuration has conflicts. For details, see the accompanying error message.

LimitExceededException
client

The request exceeded the rate limit. Retry after the specified time period.

NotFoundException
client

The requested resource is not found. Make sure that the request URI is correct.

TooManyRequestsException
client

The request has reached its throttling limit. Retry after the specified time period.

UnauthorizedException
client

The request is denied because the caller has insufficient permissions.

APIGatewayServiceException
Base exception class for all service exceptions from APIGateway service.