Class IAM

java.lang.Object
com.eqixiac.equinix.EquinixClient
com.eqixiac.equinix.IAM
All Implemented Interfaces:
Closeable, AutoCloseable
public final class IAM extends EquinixClient
The primary entry point for accessing the Equinix Identity and Access Management (IAM) API (Access v1) - Equinix's attribute-based access control (ABAC) and role-based access control (RBAC) plane.

IAM lets you describe who can do what across Equinix services through several cooperating resource families:

  • roles() / roleAssignments() - the RBAC layer: pre-defined roles and the assignment of a role to a principal within a scope.
  • accessPolicies() - project-scoped ABAC access policies, including their grants (which principals/groups/projects the policy is granted to).
  • permissionSets() - named, reusable permission sets within a project.
  • principalPolicies() - per-principal policies within a governance domain.
  • policyMasks() - project-scoped masks controlling which managed policies and permission sets are available.
  • effectivePermissions() - the computed effective permissions a principal holds within a project for a service.
  • resourceTypes() - discovery of resource types, actions, action sets, resource type actions and a service's policy schema.

Each accessor uses lazy initialization - the internal client is created on first access and reused for subsequent calls.

Service host

IAM requests go to the Access service's own host, https://access.eqix.equinix.com, declared as the hostName of the IAM functional area in apiParams_IAM.json. The unified gateway https://api.equinix.com answers 404 for these paths. The OAuth client-credentials login still goes to api.equinix.com, and the resulting bearer token is sent to the Access host. Override the host with getEquinixClient().setDomainEndPoint("IAM", ...).

Tokens for project-scoped endpoints

Organization-level calls such as roles().list() work with the client-credentials token. The project-scoped endpoints (/v1/projects/{projectId}/...: access policies, permission sets, principal policies, policy masks, effective permissions, project roles and resource types) accept only an STS-issued access-policy token (live, 2026-11-11). Build an IAM for them with IAM(BearerTokenProvider).

Project identifiers

Two formats exist. IAM paths take the spec's ProjectId, project:<id> (for example project:abc-123); the bare Resource Manager project UUID that Projects returns fails the service's project-id format check. ProjectIds.of(String) converts either form to the project: form.

Quick Start

BasicEquinixCredentials credentials = new BasicEquinixCredentials("clientId", "clientSecret");
IAM iam = new IAM(credentials);
RoleList roles = iam.roles().list();

// Project-scoped: an STS access-policy token, refreshed by the supplier.
IAM projectIam = new IAM(() -> myTokenCache.currentAccessPolicyToken());
AccessPolicy policy = projectIam.accessPolicies()
    .getByUuid(ProjectIds.of(projectUuid), "accesspolicy:my-policy");
Author:
ianjones
See Also:

  • Constructor Details

    • IAM

      public IAM(EquinixCredentials equinixCredentials)
      Creates a new IAM client using the provided credentials. Authentication occurs automatically on the first API call.
      Parameters:
      equinixCredentials - the OAuth2 credentials for authenticating with Equinix APIs

    • IAM

      public IAM(EquinixCredentials equinixCredentials, boolean isSandBoxed)
      Creates a new IAM client with optional sandbox mode.
      Parameters:
      equinixCredentials - the OAuth2 credentials for authenticating with Equinix APIs
      isSandBoxed - true to use the sandbox environment for testing; false for production

    • IAM

      public IAM(EquinixCredentialsProvider credentialsProvider)
      Creates a new IAM client whose credentials are resolved through the given provider. Authentication occurs automatically on the first API call.
      Parameters:
      credentialsProvider - supplies the OAuth2 credentials for authenticating with Equinix APIs

    • IAM

      public IAM(EquinixCredentialsProvider credentialsProvider, boolean isSandBoxed)
      Creates a new IAM client over a custom credentials provider, with optional sandbox mode.
      Parameters:
      credentialsProvider - supplies the OAuth2 credentials for authenticating with Equinix APIs
      isSandBoxed - true to use the sandbox environment for testing; false for production

    • IAM

      public IAM(EquinixCredentials equinixCredentials, EquinixConfig config)
      Creates a new IAM client with explicit EquinixConfig options.
      Parameters:
      equinixCredentials - the OAuth2 credentials for authenticating with Equinix APIs
      config - the construction-time options

    • IAM

      public IAM(EquinixCredentialsProvider credentialsProvider, EquinixConfig config)
      Creates a new IAM client over a custom credentials provider with explicit EquinixConfig options.
      Parameters:
      credentialsProvider - supplies the OAuth2 credentials for authenticating with Equinix APIs
      config - the construction-time options

    • IAM

      public IAM(BearerTokenProvider tokenProvider)
      Creates an IAM client that sends caller-supplied bearer tokens instead of logging in with client credentials. Use it for the project-scoped endpoints, which need an STS access-policy token (BearerTokenProvider.of(token), or BearerTokenProvider.from(...) to refresh it). No Equinix client id or secret is used.
      Parameters:
      tokenProvider - supplies the access-policy token

    • IAM

      public IAM(BearerTokenProvider tokenProvider, EquinixConfig config)
      Creates an IAM client that sends caller-supplied bearer tokens, with explicit EquinixConfig options.
      Parameters:
      tokenProvider - supplies the access-policy token
      config - the construction-time options

  • Method Details

    • roles

      public IAMRoles roles()
      Returns the client for the IAM roles catalog (GET /v1/roles, GET /v1/projects/{projectId}/roles).
      Returns:
      the IAMRoles client

    • roleAssignments

      public IAMRoleAssignments roleAssignments()
      Returns the client for IAM role assignments - associating a principal with a role in a scope (/v1/roleAssignments).
      Returns:
      the IAMRoleAssignments client

    • accessPolicies

      public IAMAccessPolicies accessPolicies()
      Returns the client for project-scoped IAM access policies and their grants (/v1/projects/{projectId}/accessPolicies).
      Returns:
      the IAMAccessPolicies client

    • permissionSets

      public IAMPermissionSets permissionSets()
      Returns the client for project-scoped IAM permission sets (/v1/projects/{projectId}/permissionSets).
      Returns:
      the IAMPermissionSets client

    • principalPolicies

      public IAMPrincipalPolicies principalPolicies()
      Returns the client for project-scoped IAM principal policies (/v1/projects/{projectId}/principalPolicies).
      Returns:
      the IAMPrincipalPolicies client

    • policyMasks

      public IAMPolicyMasks policyMasks()
      Returns the client for project-scoped IAM policy masks (/v1/projects/{projectId}/policyMasks).
      Returns:
      the IAMPolicyMasks client

    • effectivePermissions

      public IAMEffectivePermissions effectivePermissions()
      Returns the client for the IAM effective-permissions computation (GET /v1/projects/{projectId}/effectivePermissions).
      Returns:
      the IAMEffectivePermissions client

    • resourceTypes

      public IAMResourceTypes resourceTypes()
      Returns the client for IAM policy-authoring discovery - resource types, actions, action sets, resource type actions and the service policy schema (/v1/projects/{projectId}/resourceTypes and friends).
      Returns:
      the IAMResourceTypes client