OpenStack API Documentation

Identity API v2.0 (SUPPORTED)

Block Storage API v2 (CURRENT)
Block Storage API v1 (DEPRECATED)
Clustering API v1 (CURRENT)
Compute API (CURRENT)
Data Processing v1.1 (CURRENT)
Database Service API v1.0 (CURRENT)
Identity API v3 (CURRENT)
Identity API v3 extensions (CURRENT)
Identity API v2.0 (SUPPORTED)
Identity admin API v2.0 (SUPPORTED)
Identity API v2.0 extensions (SUPPORTED)
Image service API v2 (CURRENT)
Image service API v1 (SUPPORTED)
Networking API v2.0 (CURRENT)
Networking API v2.0 extensions (CURRENT)
Object Storage API v1 (SUPPORTED)
Orchestration API v1 (CURRENT)
Shared File Systems API v2 (CURRENT)
Shared File Systems API v1 (SUPPORTED)
Telemetry API v2 (CURRENT)

Search on this page

Identity API v2.0 (SUPPORTED)

Gets an authentication token that permits access to the OpenStack services REST API.

API versions

GET

List versions

Lists information about all Identity API versions.

Normal response codes

200 300

Error response codes

identityFault (400, 500, …), badRequest (400), unauthorized (401), forbidden (403), badMethod (405), overLimit (413), serviceUnavailable (503), itemNotFound (404)

{
    "versions": {
        "values": [
            {
                "id": "v3.4",
                "links": [
                    {
                        "href": "localhost:35357/v3/",
                        "rel": "self"
                    }
                ],
                "media-types": [
                    {
                        "base": "application/json",
                        "type": "application/vnd.openstack.identity-v3+json"
                    }
                ],
                "status": "stable",
                "updated": "2015-03-30T00:00:00Z"
            },
            {
                "id": "v2.0",
                "links": [
                    {
                        "href": "localhost:35357/v2.0/",
                        "rel": "self"
                    },
                    {
                        "href": "docs.openstack.org/",
                        "rel": "describedby",
                        "type": "text/html"
                    }
                ],
                "media-types": [
                    {
                        "base": "application/json",
                        "type": "application/vnd.openstack.identity-v2.0+json"
                    }
                ],
                "status": "stable",
                "updated": "2014-04-17T00:00:00Z"
            }
        ]
    }
}

This operation does not accept a request body.

GET

/v2.0

Show version details

Shows details for the Identity API v2.0.

Normal response codes

200 203

Error response codes

identityFault (400, 500, …), badRequest (400), unauthorized (401), forbidden (403), badMethod (405), overLimit (413), serviceUnavailable (503), itemNotFound (404)

{
    "version": {
        "status": "stable",
        "updated": "2014-04-17T00:00:00Z",
        "media-types": [
            {
                "base": "application/json",
                "type": "application/vnd.openstack.identity-v2.0+json"
            }
        ],
        "id": "v2.0",
        "links": [
            {
                "href": "localhost:5000/v2.0/",
                "rel": "self"
            },
            {
                "href": "docs.openstack.org/",
                "rel": "describedby",
                "type": "text/html"
            }
        ]
    }
}

This operation does not accept a request body.

Extensions

GET

/v2.0/extensions

List extensions

Lists available extensions.

Normal response codes

200 203

Error response codes

identityFault (400, 500, …), badRequest (400), unauthorized (401), forbidden (403), badMethod (405), overLimit (413), serviceUnavailable (503), itemNotFound (404)

{
    "extensions": {
        "values": [
            {
                "updated": "2013-07-07T12:00:0-00:00",
                "name": "OpenStack S3 API",
                "links": [
                    {
                        "href": "https://github.com/openstack/identity-api",
                        "type": "text/html",
                        "rel": "describedby"
                    }
                ],
                "namespace": "docs.openstack.org/identity/api/ext/s3tokens/v1.0",
                "alias": "s3tokens",
                "description": "OpenStack S3 API."
            },
            {
                "updated": "2013-07-23T12:00:0-00:00",
                "name": "OpenStack Keystone Endpoint Filter API",
                "links": [
                    {
                        "href": "https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-ep-filter-ext.md",
                        "type": "text/html",
                        "rel": "describedby"
                    }
                ],
                "namespace": "docs.openstack.org/identity/api/ext/OS-EP-FILTER/v1.0",
                "alias": "OS-EP-FILTER",
                "description": "OpenStack Keystone Endpoint Filter API."
            },
            {
                "updated": "2013-12-17T12:00:0-00:00",
                "name": "OpenStack Federation APIs",
                "links": [
                    {
                        "href": "https://github.com/openstack/identity-api",
                        "type": "text/html",
                        "rel": "describedby"
                    }
                ],
                "namespace": "docs.openstack.org/identity/api/ext/OS-FEDERATION/v1.0",
                "alias": "OS-FEDERATION",
                "description": "OpenStack Identity Providers Mechanism."
            },
            {
                "updated": "2013-07-11T17:14:00-00:00",
                "name": "OpenStack Keystone Admin",
                "links": [
                    {
                        "href": "https://github.com/openstack/identity-api",
                        "type": "text/html",
                        "rel": "describedby"
                    }
                ],
                "namespace": "docs.openstack.org/identity/api/ext/OS-KSADM/v1.0",
                "alias": "OS-KSADM",
                "description": "OpenStack extensions to Keystone v2.0 API enabling Administrative Operations."
            },
            {
                "updated": "2014-01-20T12:00:0-00:00",
                "name": "OpenStack Simple Certificate API",
                "links": [
                    {
                        "href": "https://github.com/openstack/identity-api",
                        "type": "text/html",
                        "rel": "describedby"
                    }
                ],
                "namespace": "docs.openstack.org/identity/api/ext/OS-SIMPLE-CERT/v1.0",
                "alias": "OS-SIMPLE-CERT",
                "description": "OpenStack simple certificate retrieval extension"
            },
            {
                "updated": "2013-07-07T12:00:0-00:00",
                "name": "OpenStack EC2 API",
                "links": [
                    {
                        "href": "https://github.com/openstack/identity-api",
                        "type": "text/html",
                        "rel": "describedby"
                    }
                ],
                "namespace": "docs.openstack.org/identity/api/ext/OS-EC2/v1.0",
                "alias": "OS-EC2",
                "description": "OpenStack EC2 Credentials backend."
            }
        ]
    }
}

This operation does not accept a request body.

This operation does not accept a request body and does not return a response body.

Tokens and tenants

POST

/v2.0/tokens

Authenticate

Authenticates and generates a token.

The Identity API is a RESTful web service. It is the entry point to all service APIs. To access the Identity API, you must know its URL.

Each REST request against Identity requires the X-Auth-Token header. Clients obtain this token, along with the URL to other service APIs, by first authenticating against Identity with valid credentials.

To authenticate, you must provide either a user ID and password or a token.

If the authentication token has expired, this call returns the HTTP 401 status code.

If the token has expired, this call returns the HTTP 404 status code.

The Identity API treats expired tokens as no longer valid tokens.

The deployment determines how long expired tokens are stored.

To view the trust object, you need to set trust enable on the keystone configuration.

Normal response codes

200 203

Error response codes

identityFault (400, 500, …), userDisabled (403), badRequest (400), unauthorized (401), forbidden (403), badMethod (405), overLimit (413), serviceUnavailable (503), itemNotFound (404)

Request parameters

Parameter	Style	Type	Description
tenantName (Optional)	plain	xsd:string	The tenant name. Both the `tenantId` and `tenantName` attributes are optional and mutually exclusive. If you specify both attributes, the server returns the `Bad Request (400)` response code.
tenantId (Optional)	plain	capi:UUID	The tenant ID. Both the `tenantId` and `tenantName` attributes are optional and mutually exclusive. If you specify both attributes, the server returns the `Bad Request (400)` response code.
passwordCredentials (Optional)	plain	xsd:string	A `passwordCredentials` object. To authenticate, you must provide either a user ID and password or a token.
username (Optional)	plain	xsd:string	The user name. Required if you include the `passwordCredentials` object. Otherwise, you must provide a token.
password (Optional)	plain	xsd:string	The password of the user. Required if you include the `passwordCredentials` object. Otherwise, you must provide a token.
token (Optional)	plain	xsd:string	A `token` object. Required if you do not provide a password credential.
id (Optional)	plain	xsd:string	The token ID. This field is required in the `token` object.

Response parameters

Parameter	Style	Type	Description
access	plain	xsd:string	An `access` object.
token	plain	xsd:string	A `token` object.
issued_at	plain	xsd:dateTime	The date and time when the token was issued. The date and time stamp format is ISO 8601: CCYY-MM-DDThh:mm:ss±hh:mm For example, `2015-08-27T09:49:58-05:00`. The `±hh:mm` value, if included, is the time zone as an offset from UTC. In the previous example, the offset value is `-05:00`.
expires	plain	xsd:dateTime	The date and time when the token expires. The date and time stamp format is ISO 8601: CCYY-MM-DDThh:mm:ss±hh:mm For example, `2015-08-27T09:49:58-05:00`. The `±hh:mm` value, if included, is the time zone as an offset from UTC. In the previous example, the offset value is `-05:00`. A `null` value indicates that the token never expires.
id	plain	xsd:string	The authentication token. In the example, the token is `my_id`.
tenant	plain	xsd:string	A `tenant` object.
description	plain	xsd:string	The description of the tenant. If not set, this value is `null`.
enabled	plain	xsd:boolean	Indicates whether the tenant is enabled or disabled.
id	plain	xsd:string	The tenant ID.
name	plain	xsd:string	The tenant name.
serviceCatalog	plain	xsd:string	A `serviceCatalog` object.
endpoints	plain	xsd:string	One or more `endpoints` objects. Each object shows the `adminURL`, `region`, `internalURL`, `id`, and `publicURL` for the endpoint.
endpoints_links	plain	xsd:string	Links for the endpoint.
type	plain	xsd:string	Endpoint type.
name	plain	xsd:string	Endpoint name.