Request Syntax URI Request Parameters Request Body Response Syntax Response Elements Errors Examples See Also

GetRequestAuthorizationDetails

Retrieves the authorization details for a specific access denied request. The details include the request context, the evaluations performed, and the policies that were evaluated.

Use this operation to understand why a request was denied. Supported services include an authorization ID in the access denied error message. Pass that ID to this operation to retrieve the details.

Authorization details are available for at least 24 hours after the denial.

To use this operation, you must have the iam:GetRequestAuthorizationDetails permission.

Request Syntax


GET /authorization-details/authorizationId?nextToken=nextToken HTTP/1.1

URI Request Parameters

The request uses the following URI parameters.

authorizationId

The authorization ID received in the access denied error message. This ID identifies the specific request to retrieve details for.

Pattern: [0123456789abcdefghijklmnopqrstuvwxyz]+

Required: Yes

nextToken

The pagination token from a previous call, used to retrieve the next page of evaluations. Omit this value on the first call.

Request Body

The request does not have a request body.

Response Syntax


HTTP/1.1 200
Content-type: application/json

{
   "evaluations": [ 
      { 
         "action": "string",
         "context": { 
            "string" : JSON value 
         },
         "evaluatedEffect": "string",
         "matchedPolicies": [ 
            { 
               "matchedStatements": [ 
                  { 
                     "evaluatedEffect": "string",
                     "sid": "string"
                  }
               ],
               "uri": "string"
            }
         ],
         "resource": "string"
      }
   ],
   "nextToken": "string",
   "policies": [ 
      { 
         "attachedTo": [ 
            { 
               "arn": "string"
            }
         ],
         "inline": boolean,
         "type": "string",
         "uri": "string"
      }
   ],
   "requestContext": { 
      "string" : JSON value 
   }
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

evaluations

The list of evaluations for this request. Each evaluation shows how a single action and resource pair was evaluated. This includes the context, the effect, and any policies that matched.

Type: Array of Evaluation objects

nextToken

The pagination token for retrieving the next page of evaluations. This value is absent when there are no more results.

Type: String

policies

The list of policies that were evaluated.

Type: Array of PolicyInfo objects

requestContext

The request context is the set of context keys and values that apply to the entire request and are shared by all evaluations.

Type: String to JSON value map

Errors

For information about the errors that are common to all actions, see Common Error Types.

AccessDeniedException

The caller does not have sufficient access to perform this action.

HTTP Status Code: 403

InternalServerException

An unexpected error occurred while processing the request. Try again.

HTTP Status Code: 500

ResourceNotFoundException

The requested authorization details do not exist in this region or have expired. Verify that the authorization ID from the access denied error message is correct and the call is made in the region where the denial occurred. Ensure that the calling principal belongs to the same account or organization as the original denied request.

HTTP Status Code: 404

ValidationException

The request is malformed or is missing one or more required parameters. Check the request parameters and try again.

HTTP Status Code: 400

Examples

Example – Retrieve authorization details for an implicitly denied iam:GetUser request

This example illustrates one usage of GetRequestAuthorizationDetails.

Sample Request


{
  "authorizationId": "a1b2c3d4e5f6g7h8i9j0"
}

Sample Response


{
  "evaluations": [
    {
      "action": "iam:GetUser",
      "context": {},
      "evaluatedEffect": "IMPLICIT_DENY",
      "matchedPolicies": [],
      "resource": "arn:aws:iam::111122223333:user/ExampleUser"
    }
  ],
  "policies": [
    {
      "attachedTo": [
        {
          "arn": "arn:aws:iam::111122223333:role/ImplicitDeny"
        }
      ],
      "inline": true,
      "type": "SESSION_POLICY",
      "uri": "inline:b6cf943c21a1966b"
    }
  ],
  "requestContext": {
    "aws:ViaAWSService": "false",
    "aws:MultiFactorAuthPresent": "false",
    "aws:TokenIssueTime": "2026-01-01T00:00:00Z",
    "aws:ResourceOrgPaths": "[o-exampleorgid/r-examp/]",
    "aws:UserAgent": "aws-cli/2.0.0 md/command#iam.get-user",
    "aws:UserId": "AROADBQP57FF2AEXAMPLE:example-session",
    "aws:ResourceOrgID": "o-exampleorgid",
    "aws:PrincipalAccount": "111122223333",
    "aws:EpochTime": "2026-01-01T00:00:00Z",
    "aws:PrincipalARN": "arn:aws:iam::111122223333:role/ImplicitDeny",
    "aws:ViaAWSMCPService": "false",
    "aws:SourceIp": "192.0.2.1/32",
    "aws:RequestedRegion": "us-east-1",
    "aws:PrincipalIsAWSService": "false",
    "aws:SecureTransport": "true",
    "aws:PrincipalOrgPaths": "[o-exampleorgid/r-examp/]",
    "aws:PrincipalOrgID": "o-exampleorgid",
    "aws:CurrentTime": "2026-01-01T00:00:00Z"
  }
}

Example – Retrieve authorization details for an explicitly denied iam:GetUser request

This example illustrates one usage of GetRequestAuthorizationDetails.

Sample Request


{
  "authorizationId": "z9y8x7w6v5u4t3s2r1q0"
}

Sample Response


{
  "evaluations": [
    {
      "action": "iam:GetUser",
      "context": {},
      "evaluatedEffect": "EXPLICIT_DENY",
      "matchedPolicies": [
        {
          "matchedStatements": [
            {
              "evaluatedEffect": "DENY",
              "sid": "DenyAll"
            }
          ],
          "uri": "arn:aws:iam::aws:policy/AWSDenyAll"
        }
      ],
      "resource": "arn:aws:iam::111122223333:user/ExampleUser"
    }
  ],
  "policies": [
    {
      "attachedTo": [
        {
          "arn": "arn:aws:iam::111122223333:role/ExplicitDeny"
        }
      ],
      "inline": false,
      "type": "IDENTITY_BASED_POLICY",
      "uri": "arn:aws:iam::aws:policy/AWSDenyAll"
    }
  ],
  "requestContext": {
    "aws:ViaAWSService": "false",
    "aws:MultiFactorAuthPresent": "false",
    "aws:TokenIssueTime": "2026-01-01T00:00:00Z",
    "aws:ResourceOrgPaths": "[o-exampleorgid/r-examp/]",
    "aws:UserAgent": "aws-cli/2.0.0 md/command#iam.get-user",
    "aws:UserId": "AROADBQP57FF2AEXAMPLE:example-session",
    "aws:ResourceOrgID": "o-exampleorgid",
    "aws:PrincipalAccount": "111122223333",
    "aws:EpochTime": "2026-01-01T00:00:00Z",
    "aws:PrincipalARN": "arn:aws:iam::111122223333:role/ExplicitDeny",
    "aws:ViaAWSMCPService": "false",
    "aws:SourceIp": "192.0.2.1/32",
    "aws:RequestedRegion": "us-east-1",
    "aws:PrincipalIsAWSService": "false",
    "aws:SecureTransport": "true",
    "aws:PrincipalOrgPaths": "[o-exampleorgid/r-examp/]",
    "aws:PrincipalOrgID": "o-exampleorgid",
    "aws:CurrentTime": "2026-01-01T00:00:00Z"
  }
}