IAM

Roles, role assignments, access policies and effective permissions from Equinix Access Management.

Scope#

The IAM domain reads and manages authorization in Equinix Access Management, that is, the roles that each principal holds on each resource.

Accessor	Covers
`roles()`	Roles, organization-wide and per project
`roleAssignments()`	Assignments of a role to a principal on a resource: list, create, get, delete
`accessPolicies()`	Access policies and their grants
`permissionSets()`	Permission sets
`principalPolicies()`, `policyMasks()`	Principal policies and masks
`effectivePermissions()`	The permissions a principal ends up with on a resource
`resourceTypes()`	Resource types and their actions

The SDK sends IAM requests to https://access.eqix.equinix.com. Release 3.0.0 sent them to api.equinix.com, which answers 404. On 2026-11-11 roles().list() returned 200 with 79 roles through the 4.0 tree.

Token type per endpoint#

Endpoint group	Accepted token
Organization-level reads such as `roles().list()`	Client-credentials token
Project-scoped endpoints: `roles().listByProject(...)`, `principalPolicies()`	Access-policy token from STS only

A client-credentials token sent to a project-scoped endpoint is answered with "only supported when using an access-policy auth token". Those calls need a client built with a BearerTokenProvider.

Reads#

Java

import com.eqixiac.equinix.iam.model.json.RoleAssignmentList;
import com.eqixiac.equinix.iam.model.json.RoleList;

RoleList roles = iam.roles().list();
roles.getList().forEach(role -> System.out.println(role.getName()));
while (roles.getNextPageToken() != null) {
    roles = iam.roles().list(roles.getNextPageToken(), 50, null);
    roles.getList().forEach(role -> System.out.println(role.getName()));
}

RoleAssignmentList assignments = iam.roleAssignments().list(projectId, "PROJECT");

IAM lists return a page object with a next-page token, as described under Pagination.

Project identifiers#

Project-scoped paths take the project in the form project:<uuid>. ProjectIds.of(uuid) adds the prefix and ProjectIds.bare(value) removes it, so a caller can pass either form.

Java

import com.eqixiac.equinix.IAM;
import com.eqixiac.equinix.core.auth.BearerTokenProvider;
import com.eqixiac.equinix.iam.client.ProjectIds;

IAM scoped = new IAM(BearerTokenProvider.of(accessPolicyToken));
RoleList projectRoles = scoped.roles().listByProject(ProjectIds.of(projectId));

Access review#

List the assignments of every project the credential can see, one line per assignment:

Java

import com.eqixiac.equinix.projects.model.Project;

for (Project project : projects.projects().list()) {
    RoleAssignmentList page = iam.roleAssignments().list(project.getProjectId(), "PROJECT");
    page.getList().forEach(assignment ->
        System.out.println(project.getProjectName() + ": " + assignment));
}

effectivePermissions().get(...) returns the permissions that one principal has on one resource after policies and masks are applied.