Skip to main content

Assume IoT user role

POST 
/v1/assumed-roles

Assumes an IoT user role for the authenticated caller. The caller is identified via the SigV4-signed request; no AWS credentials need to be passed in the body.

Regular User Flow: Returns credentials with IAM permissions scoped to all groups and subgroups the user has access to.

Scoped Flow: Because this route encodes every accessible group into one STS session policy, a caller with more than ~4 groups cannot be served at all (500). Callers in that position — and any client that only needs one group — should use the scoped variants /v1/groups/{groupId}/assumed-roles or /v1/groups/{groupId}/subgroups/{subGroupId}/assumed-roles, which encode a single group at a constant size.

MQTT client ID: the returned credentials permit iot:Connect only with client id user:<email|phone>:<session> — the caller's own login username plus a per-session suffix. The bare user:<email|phone> form is rejected. See the ESP RainMaker Neo User MQTT API (MQTT_User) spec.

Request​

Responses​

Successful response with new credentials