IAM

Some AWS-native tooling cannot use a Cosmoner API key — aws ecr get-login-password, Kubernetes image pull secrets, S3 clients. These endpoints issue scoped AWS credentials for those cases and list every credential a project has out there.

Cosmoner API keys are a different thing and are not listed here — see API Keys.

List Credentials

GET /v1/projects/:projectId/iam

Returns every AWS credential the project has issued, grouped by the service that owns it. Each group carries its own error field: a service that cannot be reached reports itself without failing the request.

{
  "success": true,
  "data": {
    "containerRegistry": {
      "users": [
        {
          "iamUserName": "dbd-ecr-<projectId>-ci-pipeline",
          "label": "ci-pipeline",
          "access": "push",
          "accessKeyId": "AKIA…",
          "createdAt": "2026-08-04T12:00:00.000Z"
        }
      ],
      "error": null
    },
    "objectStorage": [
      {
        "bucketId": "…",
        "bucketName": "assets",
        "users": [],
        "error": null
      }
    ]
  }
}

Auth: Required (member, scope: storage:read)

Create Registry Credentials

POST /v1/projects/:projectId/iam/container-registry

{
  "label": "ci-pipeline",
  "access": "push"
}

The response includes secretAccessKey, which is returned once and never stored. Lost secrets cannot be recovered — delete the credentials and create new ones.

Credentials cover every repository in the project, because repository names are scoped per project rather than per registry. Pulls made with them go straight from AWS to the client and are not metered as egress; storage is billed as usual. Returns 404 if the project has no container registry.

Auth: Required (member, write access, scope: storage:write)

Delete Registry Credentials

DELETE /v1/projects/:projectId/iam/container-registry/:iamUserName

Deletes the IAM user and its access keys. Anything using the key stops working immediately. Returns 403 if the credentials belong to another project.

Auth: Required (member, write access, scope: storage:write)

Delete Bucket Credentials

DELETE /v1/projects/:projectId/iam/object-storage/:bucketId/:iamUserName

The same for a bucket's S3 credentials. Create them from Object Storage → IAM users.

Auth: Required (member, write access, scope: storage:write)