AWS Amazon CloudDirectory

Name: Amazon CloudDirectory API
Brand: Amazon Cloud Directory
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthDirectory ServicesapiKey66 EndpointsREST

For Agents

Define schemas, create directories, and manage hierarchical or graph-based objects, attributes, and typed links for application directory data such as device fleets, org charts, and policy graphs.

Use for: I need to create a new Cloud Directory schema, Create a directory from a published schema, Attach an object as a child of another object, Run a batch read across many objects

Not supported: Does not authenticate end users, host LDAP or Active Directory, or store SSO sessions. Use for application-layer hierarchical and graph directory data only.

Amazon Cloud Directory is a fully managed, hierarchical and graph-based directory store that scales to hundreds of millions of objects. The API lets you define one or more schemas with object facets and typed-link facets, create directories from those schemas, attach and detach objects in parent-child or graph relationships, build indexes for fast lookup, and run BatchRead and BatchWrite for high-throughput composite operations. Common uses include device registries, organisational hierarchies, course catalogs, network topologies, and policy graphs that need richer relationships than a flat user directory.

Install Jentic One Beta

Connect the Amazon CloudDirectory to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Amazon CloudDirectory, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Fclouddirectory" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Fclouddirectory" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Amazon CloudDirectory API.

Create development, published, and applied schemas with object facets, attributes, and typed-link facets

Create directories backed by an applied schema and tag them for organisation

Attach and detach objects in parent-child or arbitrary typed-link relationships, supporting tree and graph models

Run BatchRead to fetch many object attributes and lookups in a single request

GET STARTED

Start building with Amazon CloudDirectory API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use Amazon CloudDirectory API for, with concrete tasks.

★ Device Fleet Hierarchy

Model a fleet of IoT devices grouped by site, building, and floor without forcing the relationships into a relational schema. Define a schema with Device, Floor, Building, and Site facets, create the directory, and attach Device objects under their Floor under Building under Site. Cloud Directory's hierarchy operations let you fetch all devices in a building in a single call, regardless of fleet size.

CreateDirectory from schemaArn=arn:aws:clouddirectory:...:schema/published/DeviceFleet/1.0, then AttachObject linking each Device object under its Floor parent in BatchWrite blocks of 20.

Organisational Chart with Policy Inheritance

Store an organisational chart with policy inheritance, so that granting a permission at the Engineering level applies to every team and person under it. Use Cloud Directory's policy facets, AttachPolicy at the desired node, and LookupPolicy at the leaf to retrieve the effective set. This is the same pattern AWS Organizations uses for SCPs and matches how IAM access often needs to flow in regulated organisations.

AttachPolicy with PolicyReference pointing at object /Engineering and ObjectReference at the policy object, then call LookupPolicy at /Engineering/Platform/jane.doe to confirm inheritance.

Indexed Attribute Lookup

Find an object by an attribute (serial number, email, IP address) in milliseconds rather than walking the hierarchy. CreateIndex on a facet attribute, AttachToIndex for each object that should be discoverable, then ListIndex to query by attribute value. Useful for any domain where users will search by an identifier rather than navigate a tree.

CreateIndex with OrderedIndexedAttributeList=[{FacetName: Device, Name: serialNumber}], then AttachToIndex for each Device, then ListIndex with RangesOnIndexedValues to query by serial number prefix.

Agent-Driven Directory Operator

Let an agent reconcile a directory with an external source of truth (a CMDB, an HR system, an MQTT registry) by streaming differences into BatchWrite calls. The agent calls Cloud Directory through Jentic so AWS credentials never leave the vault and the same reconciliation logic runs across multiple directories.

Search Jentic for 'batch write to a Cloud Directory', execute it with operations=[{CreateObject: ...}, {AttachObject: ...}] derived from the diff between the source system and ListObjectChildren on each affected parent.

Key Endpoints

66 endpoints — amazon cloud directory is a fully managed, hierarchical and graph-based directory store that scales to hundreds of millions of objects.

METHOD

PATH

DESCRIPTION

PUT

/amazonclouddirectory/2017-01-11/directory/create#x-amz-data-partition

Create a directory from a published schema

PUT

/amazonclouddirectory/2017-01-11/object#x-amz-data-partition

Create an object in a directory

PUT

/amazonclouddirectory/2017-01-11/object/attach#x-amz-data-partition

Attach an object as a child of another object

POST

/amazonclouddirectory/2017-01-11/batchread#x-amz-data-partition

Run a batch read

PUT

/amazonclouddirectory/2017-01-11/batchwrite#x-amz-data-partition

Run a batch write

PUT

/amazonclouddirectory/2017-01-11/index#x-amz-data-partition

Create an index on a facet attribute

PUT

/amazonclouddirectory/2017-01-11/policy/attach#x-amz-data-partition

Attach a policy to an object

PUT

/amazonclouddirectory/2017-01-11/typedlink/attach#x-amz-data-partition

Attach a typed link between two objects

PUT

/amazonclouddirectory/2017-01-11/directory/create#x-amz-data-partition

Create a directory from a published schema

PUT

/amazonclouddirectory/2017-01-11/object#x-amz-data-partition

Create an object in a directory

PUT

/amazonclouddirectory/2017-01-11/object/attach#x-amz-data-partition

Attach an object as a child of another object

POST

/amazonclouddirectory/2017-01-11/batchread#x-amz-data-partition

Run a batch read

PUT

/amazonclouddirectory/2017-01-11/batchwrite#x-amz-data-partition

Run a batch write

PUT

/amazonclouddirectory/2017-01-11/index#x-amz-data-partition

Create an index on a facet attribute

PUT

/amazonclouddirectory/2017-01-11/policy/attach#x-amz-data-partition

Attach a policy to an object

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring Amazon CloudDirectory by hand means holding an access key ID and secret access key, computing an AWS Signature Version 4 signature per request, resolving the correct regional clouddirectory host and passing the directory ARN partition header, and handling retries yourself. Through Jentic you install once, import Amazon CloudDirectory from the API Directory, store the AWS access key once, and your agent calls it.

Permission scoping

CloudDirectory addresses objects through references in the request body and the directory ARN header rather than the URL path, so scope your agent by the operations it needs, such as creating an object or running a batch read. You choose which operations it may call, so writes like batch write or attaching a policy are not included unless you add them.

Credential isolation

Your AWS access key ID and secret access key are stored once, encrypted, by your own Jentic One instance, and the Signature Version 4 signature is computed at execution time. The raw keys never enter the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'create a directory object' or 'read attributes across objects', and Jentic returns the matching Amazon CloudDirectory operation with its input schema so the agent calls the right endpoint without crawling the AWS reference.

FAQs

Specific to using Amazon CloudDirectory API through Jentic.

What authentication does the Amazon Cloud Directory API use?

All requests are signed with AWS Signature Version 4 using an AWS access key ID and secret access key. Through Jentic, those credentials live encrypted in the vault and Jentic computes the signature server-side, so the agent only ever holds a scoped Jentic credential.

How does Cloud Directory differ from AWS Directory Service or AWS Identity Store?

Directory Service offers managed Microsoft Active Directory and Simple AD for user authentication; Identity Store backs IAM Identity Center for SSO. Cloud Directory is an application-layer directory for arbitrary hierarchical or graph data, including device fleets, org charts, and course catalogs, not an authentication store for end users.

Can I model graph relationships, not just trees?

Yes. Beyond parent-child attachments, Cloud Directory supports typed links: named, attribute-bearing relationships between two objects. Use AttachTypedLink and ListIncomingTypedLinks or ListOutgoingTypedLinks to traverse graph-shaped data.

How do I do many writes in one call through Jentic?

Search Jentic for 'batch write to a Cloud Directory', load the BatchWrite schema, and execute it with an array of operations (CreateObject, AttachObject, UpdateObjectAttributes, etc.). The operation maps to PUT /amazonclouddirectory/2017-01-11/batchwrite and Cloud Directory applies the operations as a single composite request.

What are the rate limits for the Amazon Cloud Directory API?

Cloud Directory enforces directory-level read and write request rates that scale with directory usage; ThrottlingException is returned when exceeded. High-throughput workloads should use BatchRead and BatchWrite to amortise per-request overhead, and apply exponential backoff on retries.

Is Amazon Cloud Directory free to use?

Cloud Directory charges per object stored, per request (read and write), and a small charge for each typed link and index. There is no upfront cost or minimum commitment; you pay only for the directory data and traffic you generate.

Can I limit what my agent is allowed to do with the Amazon Cloud Directory API?

Yes. Because you run Jentic One yourself, your own rules decide which Cloud Directory operations and credentials the agent may use. Cloud Directory addresses objects through references in the request body and the directory ARN header rather than the URL path, so you scope the agent by the operations you grant it, such as creating an object or running a batch read. Writes like batch write, attaching a policy, or attaching a typed link are not available to the agent unless you add them.