IBM · Capability

IBM Cloud IAM API

The IBM Cloud Identity and Access Management (IAM) API enables you to manage IAM access tokens, API keys, service IDs, trusted profiles, and access policies. Use this API to authenticate identities, authorize access to IBM Cloud resources, and manage the full lifecycle of identity and policy objects within your IBM Cloud account.

Run with Naftiko IbmAPI

What You Can Do

POST
Createaccesstoken — Create an IAM access token
/identity/token
GET
Listapikeys — List API keys
/v1/apikeys
POST
Createapikey — Create an API key
/v1/apikeys
GET
Getapikeysdetails — Get API key details by value
/v1/apikeys/details
GET
Getapikey — Get an API key
/v1/apikeys/{id}
PUT
Updateapikey — Update an API key
/v1/apikeys/{id}
DELETE
Deleteapikey — Delete an API key
/v1/apikeys/{id}
POST
Lockapikey — Lock an API key
/v1/apikeys/{id}/lock
DELETE
Unlockapikey — Unlock an API key
/v1/apikeys/{id}/lock
POST
Disableapikey — Disable an API key
/v1/apikeys/{id}/disable
DELETE
Enableapikey — Enable an API key
/v1/apikeys/{id}/disable
GET
Listserviceids — List service IDs
/v1/serviceids/
POST
Createserviceid — Create a service ID
/v1/serviceids/
GET
Getserviceid — Get a service ID
/v1/serviceids/{id}
PUT
Updateserviceid — Update a service ID
/v1/serviceids/{id}
DELETE
Deleteserviceid — Delete a service ID
/v1/serviceids/{id}
POST
Lockserviceid — Lock a service ID
/v1/serviceids/{id}/lock
DELETE
Unlockserviceid — Unlock a service ID
/v1/serviceids/{id}/lock
GET
Listprofiles — List trusted profiles
/v1/profiles
POST
Createprofile — Create a trusted profile
/v1/profiles
GET
Getprofile — Get a trusted profile
/v1/profiles/{profile-id}
PUT
Updateprofile — Update a trusted profile
/v1/profiles/{profile-id}
DELETE
Deleteprofile — Delete a trusted profile
/v1/profiles/{profile-id}
GET
Listclaimrules — List claim rules for a trusted profile
/v1/profiles/{profile-id}/rules
POST
Createclaimrule — Create a claim rule
/v1/profiles/{profile-id}/rules
GET
Getclaimrule — Get a claim rule
/v1/profiles/{profile-id}/rules/{rule-id}
PUT
Updateclaimrule — Update a claim rule
/v1/profiles/{profile-id}/rules/{rule-id}
DELETE
Deleteclaimrule — Delete a claim rule
/v1/profiles/{profile-id}/rules/{rule-id}
GET
Listpolicies — List access policies
/v1/policies
POST
Createpolicy — Create an access policy
/v1/policies
GET
Getpolicy — Get an access policy
/v1/policies/{policy_id}
PUT
Replacepolicy — Replace an access policy
/v1/policies/{policy_id}
DELETE
Deletepolicy — Delete an access policy
/v1/policies/{policy_id}
PATCH
Updatepolicystate — Update policy state
/v1/policies/{policy_id}
GET
Listroles — List IAM roles
/v2/roles
POST
Createrole — Create a custom role
/v2/roles
GET
Getrole — Get a role
/v2/roles/{role_id}
PUT
Replacerole — Replace a custom role
/v2/roles/{role_id}
DELETE
Deleterole — Delete a custom role
/v2/roles/{role_id}

MCP Tools

createaccesstoken

Create an IAM access token

listapikeys

List API keys

read-only idempotent
createapikey

Create an API key

getapikeysdetails

Get API key details by value

read-only idempotent
getapikey

Get an API key

read-only idempotent
updateapikey

Update an API key

idempotent
deleteapikey

Delete an API key

idempotent
lockapikey

Lock an API key

unlockapikey

Unlock an API key

idempotent
disableapikey

Disable an API key

enableapikey

Enable an API key

idempotent
listserviceids

List service IDs

read-only idempotent
createserviceid

Create a service ID

getserviceid

Get a service ID

read-only idempotent
updateserviceid

Update a service ID

idempotent
deleteserviceid

Delete a service ID

idempotent
lockserviceid

Lock a service ID

unlockserviceid

Unlock a service ID

idempotent
listprofiles

List trusted profiles

read-only idempotent
createprofile

Create a trusted profile

getprofile

Get a trusted profile

read-only idempotent
updateprofile

Update a trusted profile

idempotent
deleteprofile

Delete a trusted profile

idempotent
listclaimrules

List claim rules for a trusted profile

read-only idempotent
createclaimrule

Create a claim rule

getclaimrule

Get a claim rule

read-only idempotent
updateclaimrule

Update a claim rule

idempotent
deleteclaimrule

Delete a claim rule

idempotent
listpolicies

List access policies

read-only idempotent
createpolicy

Create an access policy

getpolicy

Get an access policy

read-only idempotent
replacepolicy

Replace an access policy

idempotent
deletepolicy

Delete an access policy

idempotent
updatepolicystate

Update policy state

listroles

List IAM roles

read-only idempotent
createrole

Create a custom role

getrole

Get a role

read-only idempotent
replacerole

Replace a custom role

idempotent
deleterole

Delete a custom role

idempotent

Capability Spec

ibm-capability.yaml Raw ↑
naftiko: 1.0.0-alpha2
info:
  label: IBM Cloud IAM API
  description: The IBM Cloud Identity and Access Management (IAM) API enables you to manage IAM access tokens, API keys, service
    IDs, trusted profiles, and access policies. Use this API to authenticate identities, authorize access to IBM Cloud resources,
    and manage the full lifecycle of identity and policy objects within your IBM Cloud account.
  tags:
  - Ibm
  - API
  created: '2026-05-06'
  modified: '2026-05-06'
capability:
  consumes:
  - type: http
    namespace: ibm
    baseUri: https://iam.cloud.ibm.com
    description: IBM Cloud IAM API HTTP API.
    authentication:
      type: bearer
      token: '{{IBM_TOKEN}}'
    resources:
    - name: identity-token
      path: /identity/token
      operations:
      - name: createaccesstoken
        method: POST
        description: Create an IAM access token
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-apikeys
      path: /v1/apikeys
      operations:
      - name: listapikeys
        method: GET
        description: List API keys
        inputParameters:
        - name: account_id
          in: query
          type: string
          description: The account ID of the API keys to query.
        - name: iam_id
          in: query
          type: string
          description: The IAM ID associated with the API keys.
        - name: pagesize
          in: query
          type: integer
          description: Number of results per page.
        - name: pagetoken
          in: query
          type: string
          description: Page token from a previous request for pagination.
        - name: scope
          in: query
          type: string
          description: Scope of the query, either account or iam_id.
        - name: type
          in: query
          type: string
          description: Filter by API key type.
        - name: sort
          in: query
          type: string
          description: Field to sort by.
        - name: order
          in: query
          type: string
          description: Sort order.
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createapikey
        method: POST
        description: Create an API key
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-apikeys-details
      path: /v1/apikeys/details
      operations:
      - name: getapikeysdetails
        method: GET
        description: Get API key details by value
        inputParameters:
        - name: IAM-ApiKey
          in: header
          type: string
          description: The API key value to look up.
        - name: include_history
          in: query
          type: boolean
          description: Include activity history of the API key.
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-apikeys-id
      path: /v1/apikeys/{id}
      operations:
      - name: getapikey
        method: GET
        description: Get an API key
        inputParameters:
        - name: include_history
          in: query
          type: boolean
          description: Include the history of the API key.
        - name: include_activity
          in: query
          type: boolean
          description: Include the activity of the API key.
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updateapikey
        method: PUT
        description: Update an API key
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: deleteapikey
        method: DELETE
        description: Delete an API key
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-apikeys-id-lock
      path: /v1/apikeys/{id}/lock
      operations:
      - name: lockapikey
        method: POST
        description: Lock an API key
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: unlockapikey
        method: DELETE
        description: Unlock an API key
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-apikeys-id-disable
      path: /v1/apikeys/{id}/disable
      operations:
      - name: disableapikey
        method: POST
        description: Disable an API key
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: enableapikey
        method: DELETE
        description: Enable an API key
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-serviceids
      path: /v1/serviceids/
      operations:
      - name: listserviceids
        method: GET
        description: List service IDs
        inputParameters:
        - name: account_id
          in: query
          type: string
          description: The account ID of the service IDs to query.
        - name: name
          in: query
          type: string
          description: Filter service IDs by name.
        - name: pagesize
          in: query
          type: integer
          description: Number of results per page.
        - name: pagetoken
          in: query
          type: string
          description: Page token from a previous request for pagination.
        - name: sort
          in: query
          type: string
          description: Field to sort results by.
        - name: order
          in: query
          type: string
          description: Sort order.
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createserviceid
        method: POST
        description: Create a service ID
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-serviceids-id
      path: /v1/serviceids/{id}
      operations:
      - name: getserviceid
        method: GET
        description: Get a service ID
        inputParameters:
        - name: include_history
          in: query
          type: boolean
          description: Include the history of the service ID.
        - name: include_activity
          in: query
          type: boolean
          description: Include the activity of the service ID.
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updateserviceid
        method: PUT
        description: Update a service ID
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: deleteserviceid
        method: DELETE
        description: Delete a service ID
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-serviceids-id-lock
      path: /v1/serviceids/{id}/lock
      operations:
      - name: lockserviceid
        method: POST
        description: Lock a service ID
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: unlockserviceid
        method: DELETE
        description: Unlock a service ID
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-profiles
      path: /v1/profiles
      operations:
      - name: listprofiles
        method: GET
        description: List trusted profiles
        inputParameters:
        - name: account_id
          in: query
          type: string
          required: true
          description: The account ID to list trusted profiles for.
        - name: name
          in: query
          type: string
          description: Filter profiles by name.
        - name: pagesize
          in: query
          type: integer
          description: Number of results per page.
        - name: pagetoken
          in: query
          type: string
          description: Page token from a previous request.
        - name: sort
          in: query
          type: string
          description: Field to sort by.
        - name: order
          in: query
          type: string
          description: Sort order.
        - name: include_history
          in: query
          type: boolean
          description: Include the history of the profiles.
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createprofile
        method: POST
        description: Create a trusted profile
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-profiles-profile-id
      path: /v1/profiles/{profile-id}
      operations:
      - name: getprofile
        method: GET
        description: Get a trusted profile
        inputParameters:
        - name: include_activity
          in: query
          type: boolean
          description: Include the activity of the profile.
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updateprofile
        method: PUT
        description: Update a trusted profile
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: deleteprofile
        method: DELETE
        description: Delete a trusted profile
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-profiles-profile-id-rules
      path: /v1/profiles/{profile-id}/rules
      operations:
      - name: listclaimrules
        method: GET
        description: List claim rules for a trusted profile
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createclaimrule
        method: POST
        description: Create a claim rule
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-profiles-profile-id-rules-rule-id
      path: /v1/profiles/{profile-id}/rules/{rule-id}
      operations:
      - name: getclaimrule
        method: GET
        description: Get a claim rule
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updateclaimrule
        method: PUT
        description: Update a claim rule
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: deleteclaimrule
        method: DELETE
        description: Delete a claim rule
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-policies
      path: /v1/policies
      operations:
      - name: listpolicies
        method: GET
        description: List access policies
        inputParameters:
        - name: account_id
          in: query
          type: string
          required: true
          description: The account ID to list policies for.
        - name: iam_id
          in: query
          type: string
          description: Filter by the IAM ID of the subject.
        - name: access_group_id
          in: query
          type: string
          description: Filter by access group ID.
        - name: type
          in: query
          type: string
          description: Filter by policy type.
        - name: service_type
          in: query
          type: string
          description: Filter by service type.
        - name: state
          in: query
          type: string
          description: Filter by policy state.
        - name: limit
          in: query
          type: integer
          description: Maximum number of policies to return.
        - name: start
          in: query
          type: string
          description: Pagination start token.
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createpolicy
        method: POST
        description: Create an access policy
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v1-policies-policy-id
      path: /v1/policies/{policy_id}
      operations:
      - name: getpolicy
        method: GET
        description: Get an access policy
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: replacepolicy
        method: PUT
        description: Replace an access policy
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: deletepolicy
        method: DELETE
        description: Delete an access policy
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updatepolicystate
        method: PATCH
        description: Update policy state
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v2-roles
      path: /v2/roles
      operations:
      - name: listroles
        method: GET
        description: List IAM roles
        inputParameters:
        - name: account_id
          in: query
          type: string
          description: The account ID to list custom roles for.
        - name: service_name
          in: query
          type: string
          description: Filter roles by the service they apply to.
        - name: source_service_name
          in: query
          type: string
          description: Filter by the source service name for authorization policies.
        - name: policy_type
          in: query
          type: string
          description: Filter by policy type.
        - name: service_group_id
          in: query
          type: string
          description: Filter by the service group ID.
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createrole
        method: POST
        description: Create a custom role
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: v2-roles-role-id
      path: /v2/roles/{role_id}
      operations:
      - name: getrole
        method: GET
        description: Get a role
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: replacerole
        method: PUT
        description: Replace a custom role
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: deleterole
        method: DELETE
        description: Delete a custom role
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
  exposes:
  - type: rest
    port: 8080
    namespace: ibm-rest
    description: REST adapter for IBM Cloud IAM API.
    resources:
    - path: /identity/token
      name: createaccesstoken
      operations:
      - method: POST
        name: createaccesstoken
        description: Create an IAM access token
        call: ibm.createaccesstoken
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/apikeys
      name: listapikeys
      operations:
      - method: GET
        name: listapikeys
        description: List API keys
        call: ibm.listapikeys
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/apikeys
      name: createapikey
      operations:
      - method: POST
        name: createapikey
        description: Create an API key
        call: ibm.createapikey
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/apikeys/details
      name: getapikeysdetails
      operations:
      - method: GET
        name: getapikeysdetails
        description: Get API key details by value
        call: ibm.getapikeysdetails
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/apikeys/{id}
      name: getapikey
      operations:
      - method: GET
        name: getapikey
        description: Get an API key
        call: ibm.getapikey
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/apikeys/{id}
      name: updateapikey
      operations:
      - method: PUT
        name: updateapikey
        description: Update an API key
        call: ibm.updateapikey
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/apikeys/{id}
      name: deleteapikey
      operations:
      - method: DELETE
        name: deleteapikey
        description: Delete an API key
        call: ibm.deleteapikey
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/apikeys/{id}/lock
      name: lockapikey
      operations:
      - method: POST
        name: lockapikey
        description: Lock an API key
        call: ibm.lockapikey
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/apikeys/{id}/lock
      name: unlockapikey
      operations:
      - method: DELETE
        name: unlockapikey
        description: Unlock an API key
        call: ibm.unlockapikey
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/apikeys/{id}/disable
      name: disableapikey
      operations:
      - method: POST
        name: disableapikey
        description: Disable an API key
        call: ibm.disableapikey
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/apikeys/{id}/disable
      name: enableapikey
      operations:
      - method: DELETE
        name: enableapikey
        description: Enable an API key
        call: ibm.enableapikey
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/serviceids/
      name: listserviceids
      operations:
      - method: GET
        name: listserviceids
        description: List service IDs
        call: ibm.listserviceids
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/serviceids/
      name: createserviceid
      operations:
      - method: POST
        name: createserviceid
        description: Create a service ID
        call: ibm.createserviceid
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/serviceids/{id}
      name: getserviceid
      operations:
      - method: GET
        name: getserviceid
        description: Get a service ID
        call: ibm.getserviceid
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/serviceids/{id}
      name: updateserviceid
      operations:
      - method: PUT
        name: updateserviceid
        description: Update a service ID
        call: ibm.updateserviceid
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/serviceids/{id}
      name: deleteserviceid
      operations:
      - method: DELETE
        name: deleteserviceid
        description: Delete a service ID
        call: ibm.deleteserviceid
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/serviceids/{id}/lock
      name: lockserviceid
      operations:
      - method: POST
        name: lockserviceid
        description: Lock a service ID
        call: ibm.lockserviceid
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/serviceids/{id}/lock
      name: unlockserviceid
      operations:
      - method: DELETE
        name: unlockserviceid
        description: Unlock a service ID
        call: ibm.unlockserviceid
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/profiles
      name: listprofiles
      operations:
      - method: GET
        name: listprofiles
        description: List trusted profiles
        call: ibm.listprofiles
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/profiles
      name: createprofile
      operations:
      - method: POST
        name: createprofile
        description: Create a trusted profile
        call: ibm.createprofile
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/profiles/{profile-id}
      name: getprofile
      operations:
      - method: GET
        name: getprofile
        description: Get a trusted profile
        call: ibm.getprofile
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/profiles/{profile-id}
      name: updateprofile
      operations:
      - method: PUT
        name: updateprofile
        description: Update a trusted profile
        call: ibm.updateprofile
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/profiles/{profile-id}
      name: deleteprofile
      operations:
      - method: DELETE
        name: deleteprofile
        description: Delete a trusted profile
        call: ibm.deleteprofile
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/profiles/{profile-id}/rules
      name: listclaimrules
      operations:
      - method: GET
        name: listclaimrules
        description: List claim rules for a trusted profile
        call: ibm.listclaimrules
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/profiles/{profile-id}/rules
      name: createclaimrule
      operations:
      - method: POST
        name: createclaimrule
        description: Create a claim rule
        call: ibm.createclaimrule
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/profiles/{profile-id}/rules/{rule-id}
      name: getclaimrule
      operations:
      - method: GET
        name: getclaimrule
        description: Get a claim rule
        call: ibm.getclaimrule
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/profiles/{profile-id}/rules/{rule-id}
      name: updateclaimrule
      operations:
      - method: PUT
        name: updateclaimrule
        description: Update a claim rule
        call: ibm.updateclaimrule
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/profiles/{profile-id}/rules/{rule-id}
      name: deleteclaimrule
      operations:
      - method: DELETE
        name: deleteclaimrule
        description: Delete a claim rule
        call: ibm.deleteclaimrule
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/policies
      name: listpolicies
      operations:
      - method: GET
        name: listpolicies
        description: List access policies
        call: ibm.listpolicies
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/policies
      name: createpolicy
      operations:
      - method: POST
        name: createpolicy
        description: Create an access policy
        call: ibm.createpolicy
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/policies/{policy_id}
      name: getpolicy
      operations:
      - method: GET
        name: getpolicy
        description: Get an access policy
        call: ibm.getpolicy
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/policies/{policy_id}
      name: replacepolicy
      operations:
      - method: PUT
        name: replacepolicy
        description: Replace an access policy
        call: ibm.replacepolicy
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/policies/{policy_id}
      name: deletepolicy
      operations:
      - method: DELETE
        name: deletepolicy
        description: Delete an access policy
        call: ibm.deletepolicy
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/policies/{policy_id}
      name: updatepolicystate
      operations:
      - method: PATCH
        name: updatepolicystate
        description: Update policy state
        call: ibm.updatepolicystate
        outputParameters:
        - type: object
          mapping: $.
    - path: /v2/roles
      name: listroles
      operations:
      - method: GET
        name: listroles
        description: List IAM roles
        call: ibm.listroles
        outputParameters:
        - type: object
          mapping: $.
    - path: /v2/roles
      name: createrole
      operations:
      - method: POST
        name: createrole
        description: Create a custom role
        call: ibm.createrole
        outputParameters:
        - type: object
          mapping: $.
    - path: /v2/roles/{role_id}
      name: getrole
      operations:
      - method: GET
        name: getrole
        description: Get a role
        call: ibm.getrole
        outputParameters:
        - type: object
          mapping: $.
    - path: /v2/roles/{role_id}
      name: replacerole
      operations:
      - method: PUT
        name: replacerole
        description: Replace a custom role
        call: ibm.replacerole
        outputParameters:
        - type: object
          mapping: $.
    - path: /v2/roles/{role_id}
      name: deleterole
      operations:
      - method: DELETE
        name: deleterole
        description: Delete a custom role
        call: ibm.deleterole
        outputParameters:
        - type: object
          mapping: $.
  - type: mcp
    port: 9090
    namespace: ibm-mcp
    transport: http
    description: MCP adapter for IBM Cloud IAM API for AI agent use.
    tools:
    - name: createaccesstoken
      description: Create an IAM access token
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: ibm.createaccesstoken
      outputParameters:
      - type: object
        mapping: $.
    - name: listapikeys
      description: List API keys
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: ibm.listapikeys
      with:
        account_id: tools.account_id
        iam_id: tools.iam_id
        pagesize: tools.pagesize
        pagetoken: tools.pagetoken
        scope: tools.scope
        type: tools.type
        sort: tools.sort
        order: tools.order
      inputParameters:
      - name: account_id
        type: string
        description: The account ID of the API keys to query.
      - name: iam_id
        type: string
        description: The IAM ID associated with the API keys.
      - name: pagesize
        type: integer
        description: Number of results per page.
      - name: pagetoken
        type: string
        description: Page token from a previous request for pagination.
      - name: scope
        type: string
        description: Scope of the query, either account or iam_id.
      - name: type
        type: string
        description: Filter by API key type.
      - name: sort
        type: string
        description: Field to sort by.
      - name: order
        type: string
        description: Sort order.
      outputParameters:
      - type: object
        mapping: $.
    - name: createapikey
      description: Create an API key
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: ibm.createapikey
      outputParameters:
      - type: object
        mapping: $.
    - name: getapikeysdetails
      description: Get API key details by value
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: ibm.getapikeysdetails
      with:
        include_history: tools.include_history
      inputParameters:
      - name: include_history
        type: boolean
        description: Include activity history of the API key.
      outputParameters:
      - type: object
        mapping: $.
    - name: getapikey
      description: Get an API key
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: ibm.getapikey
      with:
        include_history: tools.include_history
        include_activity: tools.include_activity
      inputParameters:
      - name: include_history
        type: boolean
        description: Include the history of the API key.
      - name: include_activity
        type: boolean
        description: Include the activity of the API key.
      outputParameters:
      - type: object
        mapping: $.
    - name: updateapikey
      description: Update an API key
      hints:
        readOnly: false
        destructive: false
        idempotent: true
      call: ibm.updateapikey
      outputParameters:
      - type: object
        mapping: $.
    - name: deleteapikey
      description: Delete an API key
      hints:
        readOnly: false
        destructive: true
        idempotent: true
      call: ibm.deleteapikey
      outputParameters:
      - type: object
        mapping: $.
    - name: lockapikey
      description: Lock an API key
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: ibm.lockapikey
      outputParameters:
      - type: object
        mapping: $.
    - name: unlockapikey
      description: Unlock an API key
      hints:
        readOnly: false
        destructive: true
        idempotent: true
      call: ibm.unlockapikey
      outputParameters:
      - type: object
        mapping: $.
    - name: disableapikey
      description: Disable an API key
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: ibm.disableapikey
      outputParameters:
      - type: object
        mapping: $.
    - name: enableapikey
      description: Enable an API key
      hints:
        readOnly: false
        destructive: true
        idempotent: true
      call: ibm.enableapikey
      outputParameters:
      - type: object
        mapping: $.
    - name: listserviceids
      description: List service IDs
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: ibm.listserviceids
      with:
        account_id: tools.account_id
        name: tools.name
        pagesize: tools.pagesize
        pagetoken: tools.pagetoken
        sort: tools.sort
        order: tools.order
      inputParameters:
      - name: account_id
        type: string
        description: The account ID of the service IDs to query.
      - name: name
        type: string
        description: Filter service IDs by name.
      - name: pagesize
        type: integer
        description: Number of results per page.
      - name: pagetoken
        type: string
        description: Page token from a previous request for pagination.
      - name: sort
        type: string
        description: Field to sort results by.
      - name: order
        type: string
        description: Sort order.
      outputParameters:
      - type: object
        mapping: $.
    - name: createserviceid
      description: Create a service ID
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: ibm.createserviceid
      outputParameters:
      - type: object
        mapping: $.
    - name: getserviceid
      description: Get a service ID
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: ibm.getserviceid
      with:
        include_history: tools.include_history
        include_activity: tools.include_activity
      inputParameters:
      - name: include_history
        type: boolean
        description: Include the history of the service ID.
      - name: include_activity
        type: boolean
        description: Include the activity of the service ID.
      outputParameters:
      - type: object
  

# --- truncated at 32 KB (41 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/ibm/refs/heads/main/capabilities/ibm-capability.yaml