The agent skills descriptor for a registry record. Contains an optional skill markdown definition in human-readable format and an optional structured skill definition.

ApiGatewayTargetConfiguration

class ApiGatewayTargetConfiguration

The configuration for an Amazon API Gateway target.

ApiGatewayToolConfiguration

class ApiGatewayToolConfiguration

The configuration for defining REST API tool filters and overrides for the gateway target.

ApiGatewayToolFilter

class ApiGatewayToolFilter

Specifies which operations from an API Gateway REST API are exposed as tools. Tool names and descriptions are derived from the operationId and description fields in the API's exported OpenAPI specification.

ApiGatewayToolOverride

class ApiGatewayToolOverride

Settings to override configurations for a tool.

ApiKeyCredentialLocation

sealed class ApiKeyCredentialLocation

ApiKeyCredentialProviderItem

class ApiKeyCredentialProviderItem

Contains information about an API key credential provider.

ApiSchemaConfiguration

sealed class ApiSchemaConfiguration

Configuration for API schema.

ApprovalConfiguration

class ApprovalConfiguration

Configuration for the registry record approval workflow. Controls whether records added to the registry require explicit approval before becoming active.

AtlassianOauth2ProviderConfigInput

class AtlassianOauth2ProviderConfigInput

Configuration settings for connecting to Atlassian services using OAuth2 authentication. This includes the client credentials required to authenticate with Atlassian's OAuth2 authorization server.

AtlassianOauth2ProviderConfigOutput

class AtlassianOauth2ProviderConfigOutput

The configuration details returned for an Atlassian OAuth2 provider, including the client ID and OAuth2 discovery information.

AuthorizationData

sealed class AuthorizationData

Contains the authorization data that is returned when a gateway target is configured with a credential provider with authorization code grant type and requires user federation.

AuthorizerConfiguration

sealed class AuthorizerConfiguration

Represents inbound authorization configuration options used to authenticate incoming requests.

AuthorizerType

sealed class AuthorizerType

AuthorizingClaimMatchValueType

class AuthorizingClaimMatchValueType

Defines the value or values to match for and the relationship of the match.

BedrockAgentCoreControlException

open class BedrockAgentCoreControlException : AwsServiceException

Base class for all service related exceptions thrown by the BedrockAgentCoreControl client

BedrockEvaluatorModelConfig

class BedrockEvaluatorModelConfig

The configuration for using Amazon Bedrock models in evaluator assessments, including model selection and inference parameters.

BrowserEnterprisePolicy

class BrowserEnterprisePolicy

Browser enterprise policy configuration.

BrowserEnterprisePolicyType

sealed class BrowserEnterprisePolicyType

BrowserNetworkConfiguration

class BrowserNetworkConfiguration

The network configuration for a browser. This structure defines how the browser connects to the network.

BrowserNetworkMode

sealed class BrowserNetworkMode

BrowserProfileStatus

sealed class BrowserProfileStatus

The status of a browser profile.

BrowserProfileSummary

class BrowserProfileSummary

Contains summary information about a browser profile. A browser profile stores persistent browser data that can be reused across browser sessions.

BrowserSigningConfigInput

class BrowserSigningConfigInput

Configuration for enabling browser signing capabilities that allow agents to cryptographically identify themselves to websites using HTTP message signatures.

BrowserSigningConfigOutput

class BrowserSigningConfigOutput

The current browser signing configuration that shows whether cryptographic agent identification is enabled for web bot authentication.

BrowserStatus

sealed class BrowserStatus

BrowserSummary

class BrowserSummary

Contains summary information about a browser. A browser enables Amazon Bedrock AgentCore Agent to interact with web content.

CategoricalScaleDefinition

class CategoricalScaleDefinition

The definition of a categorical rating scale option that provides a named category with its description for evaluation scoring.

CedarPolicy

class CedarPolicy

Represents a Cedar policy statement within the AgentCore Policy system. Cedar is a policy language designed for authorization that provides human-readable, analyzable, and high-performance policy evaluation for controlling agent behavior and access decisions.

Certificate

class Certificate

A certificate to install in the browser or code interpreter.

CertificateLocation

sealed class CertificateLocation

The location from which to retrieve a certificate.

ClaimMatchOperatorType

sealed class ClaimMatchOperatorType

ClaimMatchValueType

sealed class ClaimMatchValueType

The value or values to match for.

ClientAuthenticationMethodType

sealed class ClientAuthenticationMethodType

CloudWatchLogsInputConfig

class CloudWatchLogsInputConfig

The configuration for reading agent traces from CloudWatch logs as input for online evaluation.

CloudWatchOutputConfig

class CloudWatchOutputConfig

The configuration for writing evaluation results to CloudWatch logs with embedded metric format (EMF) for monitoring.

Code

sealed class Code

The source code configuration that specifies the location and details of the code to be executed.

CodeBasedEvaluatorConfig

sealed class CodeBasedEvaluatorConfig

Configuration for a code-based evaluator. Specify the Lambda function to use for evaluation.

CodeConfiguration

class CodeConfiguration

The configuration for the source code that defines how the agent runtime code should be executed, including the code location, runtime environment, and entry point.

CodeInterpreterNetworkConfiguration

class CodeInterpreterNetworkConfiguration

The network configuration for a code interpreter. This structure defines how the code interpreter connects to the network.

CodeInterpreterNetworkMode

sealed class CodeInterpreterNetworkMode

CodeInterpreterStatus

sealed class CodeInterpreterStatus

CodeInterpreterSummary

class CodeInterpreterSummary

Contains summary information about a code interpreter. A code interpreter enables Amazon Bedrock AgentCore Agent to execute code.

CoinbaseCdpConfigurationInput

class CoinbaseCdpConfigurationInput

Coinbase CDP configuration — credentials provided by Coinbase Developer Platform.

CoinbaseCdpConfigurationOutput

class CoinbaseCdpConfigurationOutput

Coinbase CDP configuration output with secret ARNs.

ComponentConfiguration

class ComponentConfiguration

The configuration for a component within a configuration bundle. The component type is inferred from the component identifier ARN.

ConcurrentModificationException

class ConcurrentModificationException : BedrockAgentCoreControlException

Exception thrown when a resource is modified concurrently by multiple requests.

Condition

sealed class Condition

A condition that determines when a gateway rule applies. Conditions can match on principals or request paths.

ConfigurationBundleAction

sealed class ConfigurationBundleAction

An action that applies a configuration bundle override, either as a static override or a weighted split for A/B testing.

ConfigurationBundleReference

class ConfigurationBundleReference

A reference to a specific version of a configuration bundle.

ConfigurationBundleStatus

sealed class ConfigurationBundleStatus

ConfigurationBundleSummary

class ConfigurationBundleSummary

Summary information about a configuration bundle.

ConfigurationBundleVersionSummary

class ConfigurationBundleVersionSummary

Summary information about a configuration bundle version.

ConflictException

class ConflictException : BedrockAgentCoreControlException

This exception is thrown when there is a conflict performing an operation

ConsolidationConfiguration

sealed class ConsolidationConfiguration

Contains consolidation configuration information for a memory strategy.

ContainerConfiguration

class ContainerConfiguration

Representation of a container configuration.

Content

sealed class Content

Represents content input for policy generation operations. This structure encapsulates the natural language descriptions or other content formats that are used as input for AI-powered policy generation.

ContentConfiguration

class ContentConfiguration

Defines what content to stream and at what level of detail.

ContentLevel

sealed class ContentLevel

ContentType

sealed class ContentType

CreateAgentRuntimeEndpointRequest

class CreateAgentRuntimeEndpointRequest

CreateAgentRuntimeEndpointResponse

class CreateAgentRuntimeEndpointResponse

CreateAgentRuntimeRequest

class CreateAgentRuntimeRequest

CreateAgentRuntimeResponse

class CreateAgentRuntimeResponse

CreateApiKeyCredentialProviderRequest

class CreateApiKeyCredentialProviderRequest

CreateApiKeyCredentialProviderResponse

class CreateApiKeyCredentialProviderResponse

CreateBrowserProfileRequest

class CreateBrowserProfileRequest

CreateBrowserProfileResponse

class CreateBrowserProfileResponse

CreateBrowserRequest

class CreateBrowserRequest

CreateBrowserResponse

class CreateBrowserResponse

CreateCodeInterpreterRequest

class CreateCodeInterpreterRequest

CreateCodeInterpreterResponse

class CreateCodeInterpreterResponse

CreateConfigurationBundleRequest

class CreateConfigurationBundleRequest

CreateConfigurationBundleResponse

class CreateConfigurationBundleResponse

CreateDatasetRequest

class CreateDatasetRequest

CreateDatasetResponse

class CreateDatasetResponse

CreateDatasetVersionRequest

class CreateDatasetVersionRequest

CreateDatasetVersionResponse

class CreateDatasetVersionResponse

CreateEvaluatorRequest

class CreateEvaluatorRequest

CreateEvaluatorResponse

class CreateEvaluatorResponse

CreateGatewayRequest

class CreateGatewayRequest

CreateGatewayResponse

class CreateGatewayResponse

CreateGatewayRuleRequest

class CreateGatewayRuleRequest

CreateGatewayRuleResponse

class CreateGatewayRuleResponse

CreateGatewayTargetRequest

class CreateGatewayTargetRequest

CreateGatewayTargetResponse

class CreateGatewayTargetResponse

CreateHarnessRequest

class CreateHarnessRequest

CreateHarnessResponse

class CreateHarnessResponse

CreateMemoryRequest

class CreateMemoryRequest

CreateMemoryResponse

class CreateMemoryResponse

CreateOauth2CredentialProviderRequest

class CreateOauth2CredentialProviderRequest

CreateOauth2CredentialProviderResponse

class CreateOauth2CredentialProviderResponse

CreateOnlineEvaluationConfigRequest

class CreateOnlineEvaluationConfigRequest

CreateOnlineEvaluationConfigResponse

class CreateOnlineEvaluationConfigResponse

CreatePaymentConnectorRequest

class CreatePaymentConnectorRequest

CreatePaymentConnectorResponse

class CreatePaymentConnectorResponse

CreatePaymentCredentialProviderRequest

class CreatePaymentCredentialProviderRequest

CreatePaymentCredentialProviderResponse

class CreatePaymentCredentialProviderResponse

CreatePaymentManagerRequest

class CreatePaymentManagerRequest

CreatePaymentManagerResponse

class CreatePaymentManagerResponse

CreatePolicyEngineRequest

class CreatePolicyEngineRequest

CreatePolicyEngineResponse

class CreatePolicyEngineResponse

CreatePolicyRequest

class CreatePolicyRequest

CreatePolicyResponse

class CreatePolicyResponse

CreateRegistryRecordRequest

class CreateRegistryRecordRequest

CreateRegistryRecordResponse

class CreateRegistryRecordResponse

CreateRegistryRequest

class CreateRegistryRequest

CreateRegistryResponse

class CreateRegistryResponse

CreateWorkloadIdentityRequest

class CreateWorkloadIdentityRequest

CreateWorkloadIdentityResponse

class CreateWorkloadIdentityResponse

CredentialProvider

sealed class CredentialProvider

A credential provider for gateway authentication. This structure contains the configuration for authenticating with the target endpoint.

CredentialProviderConfiguration

class CredentialProviderConfiguration

The configuration for a credential provider. This structure defines how the gateway authenticates with the target endpoint.

CredentialProviderType

sealed class CredentialProviderType

CredentialProviderVendorType

sealed class CredentialProviderVendorType

CredentialsProviderConfiguration

sealed class CredentialsProviderConfiguration

The credential provider configuration for a payment connector. Specifies the payment provider type and its associated credential provider.

CustomClaimValidationType

class CustomClaimValidationType

Defines the name of a custom claim field and rules for finding matches to authenticate its value.

CustomConfigurationInput

sealed class CustomConfigurationInput

Input for custom configuration of a memory strategy.

CustomConsolidationConfiguration

sealed class CustomConsolidationConfiguration

Contains custom consolidation configuration information.

CustomConsolidationConfigurationInput

sealed class CustomConsolidationConfigurationInput

Input for a custom consolidation configuration.

CustomDescriptor

class CustomDescriptor

A custom descriptor for a registry record. Use this for resources such as APIs, Lambda functions, or servers that do not conform to a standard protocol like MCP or A2A.

CustomExtractionConfiguration

sealed class CustomExtractionConfiguration

Contains custom extraction configuration information.

CustomExtractionConfigurationInput

sealed class CustomExtractionConfigurationInput

Input for a custom extraction configuration.

CustomJwtAuthorizerConfiguration

class CustomJwtAuthorizerConfiguration

Configuration for inbound JWT-based authorization, specifying how incoming requests should be authenticated.

CustomMemoryStrategyInput

class CustomMemoryStrategyInput

Input for creating a custom memory strategy.

CustomOauth2ProviderConfigInput

class CustomOauth2ProviderConfigInput

Input configuration for a custom OAuth2 provider.

CustomOauth2ProviderConfigOutput

class CustomOauth2ProviderConfigOutput

Output configuration for a custom OAuth2 provider.

CustomReflectionConfiguration

sealed class CustomReflectionConfiguration

Contains configurations for a custom reflection strategy.

CustomReflectionConfigurationInput

sealed class CustomReflectionConfigurationInput

Input for a custom reflection configuration.

DatasetSchemaType

sealed class DatasetSchemaType

Format of a customer-provided source file. JSONL (JSON Lines, one object per line) is the service's native ingestion and storage format — it can be streamed line-by-line without loading the entire file into memory, which is important as the row-count cap is extended. JSON array ([{...},{...}]) is intentionally not supported at launch: it cannot be streamed (requires loading the full file into memory to parse), and all major eval frameworks (LangSmith, Ragas, DeepEval, Arize Phoenix) export as JSONL or CSV — not JSON arrays. Customers with JSON array files can Versioned schema type for dataset examples. Each value identifies both the source format and the version of that format's schema. Schema definitions (required/optional fields) are stored as constants in SchemaRegistry. The schemaType on a Dataset is immutable after creation. When a framework changes its format, a new version is added (e.g., RAGAS_V2) without breaking existing datasets using the old version. Content is always stored as-is.

DatasetStatus

sealed class DatasetStatus

Dataset lifecycle / operation status. Two-column status model: DatasetStatus tracks lifecycle state independently from DraftStatus which tracks publish synchronization. IN-FLIGHT states (busy — all writes blocked): CREATING — CreateDataset async ingestion in progress. UPDATING — Example mutation (Add/Update/Delete) or CreateDatasetVersion in progress. DELETING — Full or version-specific delete in progress. TERMINAL states (stable — operations allowed per guards below): ACTIVE — Dataset is stable. failureReason cleared. CREATE_FAILED — Initial ingestion failed. DRAFT record exists but has no examples. failureReason populated. UPDATE_FAILED — Last example mutation or CreateDatasetVersion failed. DRAFT may be partially modified. failureReason populated. DELETE_FAILED — Delete failed after retries. Dataset/S3 may be in inconsistent state. Sev-2 ticket filed (full-delete only). failureReason populated. State transitions: CreateDataset → CREATING → ACTIVE (draftStatus=MODIFIED) | CREATE_FAILED Add/Update/DeleteDatasetExamples → UPDATING → ACTIVE (draftStatus=MODIFIED) | UPDATE_FAILED CreateDatasetVersion → UPDATING → ACTIVE (draftStatus=UNMODIFIED) | UPDATE_FAILED DeleteDataset (version-specific) → DELETING → ACTIVE (draftStatus unchanged) | DELETE_FAILED DeleteDataset (full) → DELETING → (record deleted) | DELETE_FAILED [auto Sev-2] Operation guards (ConflictException codes): GetDataset / ListDatasetExamples: — Allowed for all statuses (no guard) UpdateDataset, AddDatasetExamples, DeleteDatasetExamples: — DATASET_NOT_READY if status in {CREATING, UPDATING, DELETING} — DATASET_IN_FAILED_STATE if status == DELETE_FAILED UpdateDatasetExamples: — DATASET_NOT_READY if status in {CREATING, UPDATING, DELETING} — DATASET_IN_FAILED_STATE if status in {CREATE_FAILED, DELETE_FAILED} CreateDatasetVersion: — DATASET_NOT_READY if status in {CREATING, UPDATING, DELETING} — DATASET_IN_FAILED_STATE if status in {CREATE_FAILED, DELETE_FAILED} DeleteDataset: — DATASET_NOT_READY if status in {CREATING, UPDATING, DELETING}

DatasetSummary

class DatasetSummary

Summary information about a dataset.

DatasetVersionSummary

class DatasetVersionSummary

Summary information about a published dataset version.

DataSourceConfig

sealed class DataSourceConfig

The configuration that specifies where to read agent traces for online evaluation.

DataSourceType

sealed class DataSourceType

Source of examples to add to the dataset.

DecryptionFailure

class DecryptionFailure : BedrockAgentCoreControlException

Exception thrown when decryption of a secret fails.

DeleteAgentRuntimeEndpointRequest

class DeleteAgentRuntimeEndpointRequest

DeleteAgentRuntimeEndpointResponse

class DeleteAgentRuntimeEndpointResponse

DeleteAgentRuntimeRequest

class DeleteAgentRuntimeRequest

DeleteAgentRuntimeResponse

class DeleteAgentRuntimeResponse

DeleteApiKeyCredentialProviderRequest

class DeleteApiKeyCredentialProviderRequest

DeleteApiKeyCredentialProviderResponse

class DeleteApiKeyCredentialProviderResponse

DeleteBrowserProfileRequest

class DeleteBrowserProfileRequest

DeleteBrowserProfileResponse

class DeleteBrowserProfileResponse

DeleteBrowserRequest

class DeleteBrowserRequest

DeleteBrowserResponse

class DeleteBrowserResponse

DeleteCodeInterpreterRequest

class DeleteCodeInterpreterRequest

DeleteCodeInterpreterResponse

class DeleteCodeInterpreterResponse

DeleteConfigurationBundleRequest

class DeleteConfigurationBundleRequest

DeleteConfigurationBundleResponse

class DeleteConfigurationBundleResponse

DeleteDatasetExamplesRequest

class DeleteDatasetExamplesRequest

DeleteDatasetExamplesResponse

class DeleteDatasetExamplesResponse

DeleteDatasetRequest

class DeleteDatasetRequest

DeleteDatasetResponse

class DeleteDatasetResponse

DeleteEvaluatorRequest

class DeleteEvaluatorRequest

DeleteEvaluatorResponse

class DeleteEvaluatorResponse

DeleteGatewayRequest

class DeleteGatewayRequest

DeleteGatewayResponse

class DeleteGatewayResponse

DeleteGatewayRuleRequest

class DeleteGatewayRuleRequest

DeleteGatewayRuleResponse

class DeleteGatewayRuleResponse

DeleteGatewayTargetRequest

class DeleteGatewayTargetRequest

DeleteGatewayTargetResponse

class DeleteGatewayTargetResponse

DeleteHarnessRequest

class DeleteHarnessRequest

DeleteHarnessResponse

class DeleteHarnessResponse

DeleteMemoryRequest

class DeleteMemoryRequest

DeleteMemoryResponse

class DeleteMemoryResponse

DeleteMemoryStrategyInput

class DeleteMemoryStrategyInput

Input for deleting a memory strategy.

DeleteOauth2CredentialProviderRequest

class DeleteOauth2CredentialProviderRequest

DeleteOauth2CredentialProviderResponse

class DeleteOauth2CredentialProviderResponse

DeleteOnlineEvaluationConfigRequest

class DeleteOnlineEvaluationConfigRequest

DeleteOnlineEvaluationConfigResponse

class DeleteOnlineEvaluationConfigResponse

DeletePaymentConnectorRequest

class DeletePaymentConnectorRequest

DeletePaymentConnectorResponse

class DeletePaymentConnectorResponse

DeletePaymentCredentialProviderRequest

class DeletePaymentCredentialProviderRequest

DeletePaymentCredentialProviderResponse

class DeletePaymentCredentialProviderResponse

DeletePaymentManagerRequest

class DeletePaymentManagerRequest

DeletePaymentManagerResponse

class DeletePaymentManagerResponse

DeletePolicyEngineRequest

class DeletePolicyEngineRequest

DeletePolicyEngineResponse

class DeletePolicyEngineResponse

DeletePolicyRequest

class DeletePolicyRequest

DeletePolicyResponse

class DeletePolicyResponse

DeleteRegistryRecordRequest

class DeleteRegistryRecordRequest

DeleteRegistryRecordResponse

class DeleteRegistryRecordResponse

DeleteRegistryRequest

class DeleteRegistryRequest

DeleteRegistryResponse

class DeleteRegistryResponse

DeleteResourcePolicyRequest

class DeleteResourcePolicyRequest

DeleteResourcePolicyResponse

class DeleteResourcePolicyResponse

DeleteWorkloadIdentityRequest

class DeleteWorkloadIdentityRequest

DeleteWorkloadIdentityResponse

class DeleteWorkloadIdentityResponse

Descriptors

class Descriptors

Contains descriptor-type-specific configurations for a registry record. Only the descriptor matching the record's descriptorType should be populated.

DescriptorType

sealed class DescriptorType

DraftStatus

sealed class DraftStatus

Publish synchronization state of the DRAFT working copy. Tracks whether the current DRAFT content has been published as a version. Only authoritative when DatasetStatus == ACTIVE. Not meaningful during in-flight or failed states. Transitions: CreateDataset succeeds → MODIFIED (DRAFT has content with no published version yet) Add/Update/DeleteExamples succeed → MODIFIED (DRAFT differs from last published version) CreateDatasetVersion succeeds → UNMODIFIED (DRAFT matches the version just published)

EfsAccessPointConfiguration

class EfsAccessPointConfiguration

Configuration for an Amazon EFS access point filesystem mounted into the AgentCore Runtime. EFS access points provide shared file storage accessible from your AgentCore Runtime sessions.

EncryptionFailure

class EncryptionFailure : BedrockAgentCoreControlException

Exception thrown when encryption of a secret fails.

EndpointIpAddressType

sealed class EndpointIpAddressType

EpisodicConsolidationOverride

class EpisodicConsolidationOverride

Contains configurations to override the default consolidation step for the episodic memory strategy.

EpisodicExtractionOverride

class EpisodicExtractionOverride

Contains configurations to override the default extraction step for the episodic memory strategy.

EpisodicMemoryStrategyInput

class EpisodicMemoryStrategyInput

Input for creating an episodic memory strategy.

EpisodicOverrideConfigurationInput

class EpisodicOverrideConfigurationInput

Input for the configuration to override the episodic memory strategy.

EpisodicOverrideConsolidationConfigurationInput

class EpisodicOverrideConsolidationConfigurationInput

Configurations for overriding the consolidation step of the episodic memory strategy.

EpisodicOverrideExtractionConfigurationInput

class EpisodicOverrideExtractionConfigurationInput

Configurations for overriding the extraction step of the episodic memory strategy.

EpisodicOverrideReflectionConfigurationInput

class EpisodicOverrideReflectionConfigurationInput

Configurations for overriding the reflection step of the episodic memory strategy.

EpisodicReflectionConfiguration

class EpisodicReflectionConfiguration

The configuration for the reflections created with the episodic memory strategy.

EpisodicReflectionConfigurationInput

class EpisodicReflectionConfigurationInput

An episodic reflection configuration input.

EpisodicReflectionOverride

class EpisodicReflectionOverride

Contains configurations to override the default reflection step for the episodic memory strategy.

EvaluatorConfig

sealed class EvaluatorConfig

The configuration that defines how an evaluator assesses agent performance, including the evaluation method and parameters.

EvaluatorLevel

sealed class EvaluatorLevel

EvaluatorModelConfig

sealed class EvaluatorModelConfig

The model configuration that specifies which foundation model to use for evaluation and how to configure it.

EvaluatorReference

sealed class EvaluatorReference

The reference to an evaluator used in online evaluation configurations, containing the evaluator identifier.

EvaluatorStatus

sealed class EvaluatorStatus

EvaluatorSummary

class EvaluatorSummary

The summary information about an evaluator, including basic metadata and status information.

EvaluatorType

sealed class EvaluatorType

ExceptionLevel

sealed class ExceptionLevel

ExtractionConfig

sealed class ExtractionConfig

Configuration for metadata extraction from conversational content.

ExtractionConfiguration

sealed class ExtractionConfiguration

Contains extraction configuration information for a memory strategy.

FilesystemConfiguration

sealed class FilesystemConfiguration

Configuration for a filesystem that can be mounted into the AgentCore Runtime.

Filter

class Filter

The filter that applies conditions to agent traces during online evaluation to determine which traces should be evaluated.

FilterOperator

sealed class FilterOperator

FilterValue

sealed class FilterValue

The value used in filter comparisons, supporting different data types for flexible filtering criteria.

Finding

class Finding

Represents a finding or issue discovered during policy generation or validation. Findings provide insights about potential problems, recommendations, or validation results from policy analysis operations. Finding types include: VALID (policy is ready to use), INVALID (policy has validation errors that must be fixed), NOT_TRANSLATABLE (input couldn't be converted to policy), ALLOW_ALL (policy would allow all actions, potential security risk), ALLOW_NONE (policy would allow no actions, unusable), DENY_ALL (policy would deny all actions, may be too restrictive), and DENY_NONE (policy would deny no actions, ineffective). Review all findings before creating policies from generated assets to ensure they match your security requirements.

FindingType

sealed class FindingType

FromUrlSynchronizationConfiguration

class FromUrlSynchronizationConfiguration

Configuration for synchronizing from a URL-based MCP server.

GatewayApiKeyCredentialProvider

class GatewayApiKeyCredentialProvider

An API key credential provider for gateway authentication. This structure contains the configuration for authenticating with the target endpoint using an API key.

GatewayInterceptionPoint

sealed class GatewayInterceptionPoint

GatewayInterceptorConfiguration

class GatewayInterceptorConfiguration

The configuration for an interceptor on a gateway. This structure defines settings for an interceptor that will be invoked during the invocation of the gateway.

GatewayPolicyEngineConfiguration

class GatewayPolicyEngineConfiguration

The configuration for a policy engine associated with a gateway. A policy engine is a collection of policies that evaluates and authorizes agent tool calls. When associated with a gateway, the policy engine intercepts all agent requests and determines whether to allow or deny each action based on the defined policies.

GatewayPolicyEngineMode

sealed class GatewayPolicyEngineMode

GatewayProtocolConfiguration

sealed class GatewayProtocolConfiguration

The configuration for a gateway protocol. This structure defines how the gateway communicates with external services.

GatewayProtocolType

sealed class GatewayProtocolType

GatewayRuleDetail

class GatewayRuleDetail

Detailed information about a gateway rule.

GatewayRuleStatus

sealed class GatewayRuleStatus

GatewayStatus

sealed class GatewayStatus

GatewaySummary

class GatewaySummary

Contains summary information about a gateway.

GatewayTarget

class GatewayTarget

The gateway target.

GetAgentRuntimeEndpointRequest

class GetAgentRuntimeEndpointRequest

GetAgentRuntimeEndpointResponse

class GetAgentRuntimeEndpointResponse

GetAgentRuntimeRequest

class GetAgentRuntimeRequest

GetAgentRuntimeResponse

class GetAgentRuntimeResponse

GetApiKeyCredentialProviderRequest

class GetApiKeyCredentialProviderRequest

GetApiKeyCredentialProviderResponse

class GetApiKeyCredentialProviderResponse

GetBrowserProfileRequest

class GetBrowserProfileRequest

GetBrowserProfileResponse

class GetBrowserProfileResponse

GetBrowserRequest

class GetBrowserRequest

GetBrowserResponse

class GetBrowserResponse

GetCodeInterpreterRequest

class GetCodeInterpreterRequest

GetCodeInterpreterResponse

class GetCodeInterpreterResponse

GetConfigurationBundleRequest

class GetConfigurationBundleRequest

GetConfigurationBundleResponse

class GetConfigurationBundleResponse

GetConfigurationBundleVersionRequest

class GetConfigurationBundleVersionRequest

GetConfigurationBundleVersionResponse

class GetConfigurationBundleVersionResponse

GetDatasetRequest

class GetDatasetRequest

GetDatasetResponse

class GetDatasetResponse

GetEvaluatorRequest

class GetEvaluatorRequest

GetEvaluatorResponse

class GetEvaluatorResponse

GetGatewayRequest

class GetGatewayRequest

GetGatewayResponse

class GetGatewayResponse

GetGatewayRuleRequest

class GetGatewayRuleRequest

GetGatewayRuleResponse

class GetGatewayRuleResponse

Create response excludes updatedAt (redundant on create). Get/Update responses include it via their own output structures.

GetGatewayTargetRequest

class GetGatewayTargetRequest

GetGatewayTargetResponse

class GetGatewayTargetResponse

GetHarnessRequest

class GetHarnessRequest

GetHarnessResponse

class GetHarnessResponse

GetMemoryRequest

class GetMemoryRequest

GetMemoryResponse

class GetMemoryResponse

GetOauth2CredentialProviderRequest

class GetOauth2CredentialProviderRequest

GetOauth2CredentialProviderResponse

class GetOauth2CredentialProviderResponse

GetOnlineEvaluationConfigRequest

class GetOnlineEvaluationConfigRequest

GetOnlineEvaluationConfigResponse

class GetOnlineEvaluationConfigResponse

GetPaymentConnectorRequest

class GetPaymentConnectorRequest

GetPaymentConnectorResponse

class GetPaymentConnectorResponse

GetPaymentCredentialProviderRequest

class GetPaymentCredentialProviderRequest

GetPaymentCredentialProviderResponse

class GetPaymentCredentialProviderResponse

GetPaymentManagerRequest

class GetPaymentManagerRequest

GetPaymentManagerResponse

class GetPaymentManagerResponse

GetPolicyEngineRequest

class GetPolicyEngineRequest

GetPolicyEngineResponse

class GetPolicyEngineResponse

GetPolicyEngineSummaryRequest

class GetPolicyEngineSummaryRequest

GetPolicyEngineSummaryResponse

class GetPolicyEngineSummaryResponse

GetPolicyGenerationRequest

class GetPolicyGenerationRequest

GetPolicyGenerationResponse

class GetPolicyGenerationResponse

GetPolicyGenerationSummaryRequest

class GetPolicyGenerationSummaryRequest

GetPolicyGenerationSummaryResponse

class GetPolicyGenerationSummaryResponse

GetPolicyRequest

class GetPolicyRequest

GetPolicyResponse

class GetPolicyResponse

GetPolicySummaryRequest

class GetPolicySummaryRequest

GetPolicySummaryResponse

class GetPolicySummaryResponse

GetRegistryRecordRequest

class GetRegistryRecordRequest

GetRegistryRecordResponse

class GetRegistryRecordResponse

GetRegistryRequest

class GetRegistryRequest

GetRegistryResponse

class GetRegistryResponse

GetResourcePolicyRequest

class GetResourcePolicyRequest

GetResourcePolicyResponse

class GetResourcePolicyResponse

GetTokenVaultRequest

class GetTokenVaultRequest

GetTokenVaultResponse

class GetTokenVaultResponse

GetWorkloadIdentityRequest

class GetWorkloadIdentityRequest

GetWorkloadIdentityResponse

class GetWorkloadIdentityResponse

GithubOauth2ProviderConfigInput

class GithubOauth2ProviderConfigInput

Input configuration for a GitHub OAuth2 provider.

GithubOauth2ProviderConfigOutput

class GithubOauth2ProviderConfigOutput

Output configuration for a GitHub OAuth2 provider.

GoogleOauth2ProviderConfigInput

class GoogleOauth2ProviderConfigInput

Input configuration for a Google OAuth2 provider.

GoogleOauth2ProviderConfigOutput

class GoogleOauth2ProviderConfigOutput

Output configuration for a Google OAuth2 provider.

Harness

class Harness

Representation of a Harness.

HarnessAgentCoreBrowserConfig

class HarnessAgentCoreBrowserConfig

Configuration for AgentCore Browser.

HarnessAgentCoreCodeInterpreterConfig

class HarnessAgentCoreCodeInterpreterConfig

Configuration for AgentCore Code Interpreter.

HarnessAgentCoreGatewayConfig

class HarnessAgentCoreGatewayConfig

Configuration for AgentCore Gateway.

HarnessAgentCoreMemoryConfiguration

class HarnessAgentCoreMemoryConfiguration

Configuration for AgentCore Memory integration.

HarnessAgentCoreMemoryRetrievalConfig

class HarnessAgentCoreMemoryRetrievalConfig

Configuration for memory retrieval within a namespace.

HarnessAgentCoreRuntimeEnvironment

class HarnessAgentCoreRuntimeEnvironment

The AgentCore Runtime environment for a harness.

HarnessAgentCoreRuntimeEnvironmentRequest

class HarnessAgentCoreRuntimeEnvironmentRequest

The AgentCore Runtime environment request configuration.

HarnessBedrockModelConfig

class HarnessBedrockModelConfig

Configuration for an Amazon Bedrock model provider.

HarnessEnvironmentArtifact

sealed class HarnessEnvironmentArtifact

The environment artifact for a harness, such as a container image containing custom dependencies.

HarnessEnvironmentProvider

sealed class HarnessEnvironmentProvider

The environment provider for a harness.

HarnessEnvironmentProviderRequest

sealed class HarnessEnvironmentProviderRequest

The environment provider request configuration.

HarnessGatewayOutboundAuth

sealed class HarnessGatewayOutboundAuth

Authentication method for calling a Gateway.

HarnessGeminiModelConfig

class HarnessGeminiModelConfig

Configuration for a Google Gemini model provider. Requires an API key stored in AgentCore Identity.

HarnessInlineFunctionConfig

class HarnessInlineFunctionConfig

Configuration for an inline function tool. When the agent calls this tool, the tool call is returned to the caller for external execution.

HarnessMemoryConfiguration

sealed class HarnessMemoryConfiguration

The memory configuration for a harness.

HarnessModelConfiguration

sealed class HarnessModelConfiguration

Specification of which model to use.

HarnessOpenAiModelConfig

class HarnessOpenAiModelConfig

Configuration for an OpenAI model provider. Requires an API key stored in AgentCore Identity.

HarnessRemoteMcpConfig

class HarnessRemoteMcpConfig

Configuration for connecting to a remote MCP server.

HarnessSkill

sealed class HarnessSkill

A skill available to the agent.

HarnessSlidingWindowConfiguration

class HarnessSlidingWindowConfiguration

Configuration for sliding window truncation strategy.

HarnessStatus

sealed class HarnessStatus

HarnessSummarizationConfiguration

class HarnessSummarizationConfiguration

Configuration for summarization-based truncation strategy.

HarnessSummary

class HarnessSummary

Summary information about a harness.

HarnessSystemContentBlock

sealed class HarnessSystemContentBlock

A content block in the system prompt.

HarnessTool

class HarnessTool

A tool available to the agent loop.

HarnessToolConfiguration

sealed class HarnessToolConfiguration

Configuration union for different tool types.

HarnessToolType

sealed class HarnessToolType

HarnessTruncationConfiguration

class HarnessTruncationConfiguration

Configuration for truncating conversation context when it exceeds model limits.

HarnessTruncationStrategy

sealed class HarnessTruncationStrategy

HarnessTruncationStrategyConfiguration

sealed class HarnessTruncationStrategyConfiguration

Strategy-specific truncation configuration.

HttpTargetConfiguration

sealed class HttpTargetConfiguration

The HTTP target configuration for a gateway target. Contains the configuration for HTTP-based target endpoints.

IamCredentialProvider

class IamCredentialProvider

An IAM credential provider for gateway authentication. This structure contains the configuration for authenticating with the target endpoint using IAM credentials and SigV4 signing.

IamPrincipal

class IamPrincipal

An IAM principal specification for rule matching.

InboundTokenClaimValueType

sealed class InboundTokenClaimValueType

IncludedData

sealed class IncludedData

IncludedOauth2ProviderConfigInput

class IncludedOauth2ProviderConfigInput

Configuration settings for connecting to a supported OAuth2 provider. This includes client credentials and OAuth2 discovery information for providers that have built-in support.

IncludedOauth2ProviderConfigOutput

class IncludedOauth2ProviderConfigOutput

The configuration details returned for a supported OAuth2 provider, including client credentials and OAuth2 discovery information.

IndexedKey

class IndexedKey

A metadata key indexed for filtering.

InferenceConfiguration

class InferenceConfiguration

The configuration parameters that control how the foundation model behaves during evaluation, including response generation settings.

InlineExamplesSource

class InlineExamplesSource

Inline examples provided directly in the request body.

InterceptorConfiguration

sealed class InterceptorConfiguration

The interceptor configuration.

InterceptorInputConfiguration

class InterceptorInputConfiguration

The input configuration of the interceptor.

InternalServerException

class InternalServerException : BedrockAgentCoreControlException

This exception is thrown if there was an unexpected error during processing of request

InvocationConfiguration

class InvocationConfiguration

The configuration to invoke a self-managed memory processing pipeline with.

InvocationConfigurationInput

class InvocationConfigurationInput

The configuration to invoke a self-managed memory processing pipeline with.

KeyType

sealed class KeyType

KinesisResource

class KinesisResource

Configuration for Kinesis Data Stream delivery.

KmsConfiguration

class KmsConfiguration

Contains the KMS configuration for a resource.

LambdaEvaluatorConfig

class LambdaEvaluatorConfig

Configuration for a Lambda function used as a code-based evaluator.

LambdaInterceptorConfiguration

class LambdaInterceptorConfiguration

The lambda configuration for the interceptor

LifecycleConfiguration

class LifecycleConfiguration

LifecycleConfiguration lets you manage the lifecycle of runtime sessions and resources in AgentCore Runtime. This configuration helps optimize resource utilization by automatically cleaning up idle sessions and preventing long-running instances from consuming resources indefinitely.

LinkedinOauth2ProviderConfigInput

class LinkedinOauth2ProviderConfigInput

Configuration settings for connecting to LinkedIn services using OAuth2 authentication. This includes the client credentials required to authenticate with LinkedIn's OAuth2 authorization server.

LinkedinOauth2ProviderConfigOutput

class LinkedinOauth2ProviderConfigOutput

The configuration details returned for a LinkedIn OAuth2 provider, including the client ID and OAuth2 discovery information.

ListAgentRuntimeEndpointsRequest

class ListAgentRuntimeEndpointsRequest

ListAgentRuntimeEndpointsResponse

class ListAgentRuntimeEndpointsResponse

ListAgentRuntimesRequest

class ListAgentRuntimesRequest

ListAgentRuntimesResponse

class ListAgentRuntimesResponse

ListAgentRuntimeVersionsRequest

class ListAgentRuntimeVersionsRequest

ListAgentRuntimeVersionsResponse

class ListAgentRuntimeVersionsResponse

ListApiKeyCredentialProvidersRequest

class ListApiKeyCredentialProvidersRequest

ListApiKeyCredentialProvidersResponse

class ListApiKeyCredentialProvidersResponse

ListBrowserProfilesRequest

class ListBrowserProfilesRequest

ListBrowserProfilesResponse

class ListBrowserProfilesResponse

ListBrowsersRequest

class ListBrowsersRequest

ListBrowsersResponse

class ListBrowsersResponse

ListCodeInterpretersRequest

class ListCodeInterpretersRequest

ListCodeInterpretersResponse

class ListCodeInterpretersResponse

ListConfigurationBundlesRequest

class ListConfigurationBundlesRequest

ListConfigurationBundlesResponse

class ListConfigurationBundlesResponse

ListConfigurationBundleVersionsRequest

class ListConfigurationBundleVersionsRequest

ListConfigurationBundleVersionsResponse

class ListConfigurationBundleVersionsResponse

ListDatasetExamplesRequest

class ListDatasetExamplesRequest

ListDatasetExamplesResponse

class ListDatasetExamplesResponse

ListDatasetsRequest

class ListDatasetsRequest

ListDatasetsResponse

class ListDatasetsResponse

ListDatasetVersionsRequest

class ListDatasetVersionsRequest

ListDatasetVersionsResponse

class ListDatasetVersionsResponse

ListEvaluatorsRequest

class ListEvaluatorsRequest

ListEvaluatorsResponse

class ListEvaluatorsResponse

ListGatewayRulesRequest

class ListGatewayRulesRequest

ListGatewayRulesResponse

class ListGatewayRulesResponse

ListGatewaysRequest

class ListGatewaysRequest

ListGatewaysResponse

class ListGatewaysResponse

ListGatewayTargetsRequest

class ListGatewayTargetsRequest

ListGatewayTargetsResponse

class ListGatewayTargetsResponse

ListHarnessesRequest

class ListHarnessesRequest

ListHarnessesResponse

class ListHarnessesResponse

ListingMode

sealed class ListingMode

ListMemoriesRequest

class ListMemoriesRequest

ListMemoriesResponse

class ListMemoriesResponse

ListOauth2CredentialProvidersRequest

class ListOauth2CredentialProvidersRequest

ListOauth2CredentialProvidersResponse

class ListOauth2CredentialProvidersResponse

ListOnlineEvaluationConfigsRequest

class ListOnlineEvaluationConfigsRequest

ListOnlineEvaluationConfigsResponse

class ListOnlineEvaluationConfigsResponse

ListPaymentConnectorsRequest

class ListPaymentConnectorsRequest

ListPaymentConnectorsResponse

class ListPaymentConnectorsResponse

ListPaymentCredentialProvidersRequest

class ListPaymentCredentialProvidersRequest

ListPaymentCredentialProvidersResponse

class ListPaymentCredentialProvidersResponse

ListPaymentManagersRequest

class ListPaymentManagersRequest

ListPaymentManagersResponse

class ListPaymentManagersResponse

ListPoliciesRequest

class ListPoliciesRequest

ListPoliciesResponse

class ListPoliciesResponse

ListPolicyEnginesRequest

class ListPolicyEnginesRequest

ListPolicyEnginesResponse

class ListPolicyEnginesResponse

ListPolicyEngineSummariesRequest

class ListPolicyEngineSummariesRequest

ListPolicyEngineSummariesResponse

class ListPolicyEngineSummariesResponse

ListPolicyGenerationAssetsRequest

class ListPolicyGenerationAssetsRequest

ListPolicyGenerationAssetsResponse

class ListPolicyGenerationAssetsResponse

ListPolicyGenerationsRequest

class ListPolicyGenerationsRequest

ListPolicyGenerationsResponse

class ListPolicyGenerationsResponse

ListPolicyGenerationSummariesRequest

class ListPolicyGenerationSummariesRequest

ListPolicyGenerationSummariesResponse

class ListPolicyGenerationSummariesResponse

ListPolicySummariesRequest

class ListPolicySummariesRequest

ListPolicySummariesResponse

class ListPolicySummariesResponse

ListRegistriesRequest

class ListRegistriesRequest

ListRegistriesResponse

class ListRegistriesResponse

ListRegistryRecordsRequest

class ListRegistryRecordsRequest

ListRegistryRecordsResponse

class ListRegistryRecordsResponse

ListTagsForResourceRequest

class ListTagsForResourceRequest

ListTagsForResourceResponse

class ListTagsForResourceResponse

ListWorkloadIdentitiesRequest

class ListWorkloadIdentitiesRequest

ListWorkloadIdentitiesResponse

class ListWorkloadIdentitiesResponse

LlmAsAJudgeEvaluatorConfig

class LlmAsAJudgeEvaluatorConfig

The configuration for LLM-as-a-Judge evaluation that uses a language model to assess agent performance based on custom instructions and rating scales.

LlmExtractionConfig

class LlmExtractionConfig

Model-based metadata extraction configuration.

ManagedResourceDetails

class ManagedResourceDetails

Details of a resource created and managed by the gateway for private endpoint connectivity.

ManagedVpcResource

class ManagedVpcResource

Configuration for a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resource gateway and resource configuration on your behalf using a service-linked role.

MatchPaths

class MatchPaths

A condition that matches requests based on the request path.

MatchPrincipalEntry

sealed class MatchPrincipalEntry

Union for principal matching. Currently supports IAM principal ARN glob matching.

MatchPrincipals

class MatchPrincipals

A condition that matches requests based on the caller's identity.

McpDescriptor

class McpDescriptor

The Model Context Protocol (MCP) descriptor for a registry record. Contains the server definition and tools definition for an MCP-compatible server. The schema is validated against the MCP protocol specification.

McpGatewayConfiguration

class McpGatewayConfiguration

The configuration for a Model Context Protocol (MCP) gateway. This structure defines how the gateway implements the MCP protocol.

McpLambdaTargetConfiguration

class McpLambdaTargetConfiguration

The Lambda configuration for a Model Context Protocol target. This structure defines how the gateway uses a Lambda function to communicate with the target.

McpServerTargetConfiguration

class McpServerTargetConfiguration

The target configuration for the MCP server.

McpTargetConfiguration

sealed class McpTargetConfiguration

The Model Context Protocol (MCP) configuration for a target. This structure defines how the gateway uses MCP to communicate with the target.

McpToolSchemaConfiguration

sealed class McpToolSchemaConfiguration

The MCP tool schema configuration for an MCP server target. The tool schema must be aligned with the MCP specification.

Memory

class Memory

Contains information about a memory resource.

MemoryRecordSchema

class MemoryRecordSchema

Schema for metadata on memory records generated by a strategy.

MemoryStatus

sealed class MemoryStatus

MemoryStrategy

class MemoryStrategy

Contains information about a memory strategy.

MemoryStrategyInput

sealed class MemoryStrategyInput

Contains input information for creating a memory strategy.

MemoryStrategyStatus

sealed class MemoryStrategyStatus

MemoryStrategyType

sealed class MemoryStrategyType

MemorySummary

class MemorySummary

Contains summary information about a memory resource.

MemoryView

sealed class MemoryView

MessageBasedTrigger

class MessageBasedTrigger

The trigger configuration based on a message.

MessageBasedTriggerInput

class MessageBasedTriggerInput

The trigger configuration based on a message.

MetadataConfiguration

class MetadataConfiguration

Configuration for HTTP header and query parameter propagation between the gateway and target servers.

MetadataSchemaEntry

class MetadataSchemaEntry

A metadata field definition within a strategy's schema.

MetadataValueType

sealed class MetadataValueType

MicrosoftOauth2ProviderConfigInput

class MicrosoftOauth2ProviderConfigInput

Input configuration for a Microsoft OAuth2 provider.

MicrosoftOauth2ProviderConfigOutput

class MicrosoftOauth2ProviderConfigOutput

Output configuration for a Microsoft OAuth2 provider.

ModifyConsolidationConfiguration

sealed class ModifyConsolidationConfiguration

Contains information for modifying a consolidation configuration.

ModifyExtractionConfiguration

sealed class ModifyExtractionConfiguration

Contains information for modifying an extraction configuration.

ModifyInvocationConfigurationInput

class ModifyInvocationConfigurationInput

The configuration for updating invocation settings.

ModifyMemoryStrategies

class ModifyMemoryStrategies

Contains information for modifying memory strategies.

ModifyMemoryStrategyInput

class ModifyMemoryStrategyInput

Input for modifying a memory strategy.

ModifyReflectionConfiguration

sealed class ModifyReflectionConfiguration

Contains information for modifying a reflection configuration.

ModifySelfManagedConfiguration

class ModifySelfManagedConfiguration

The configuration for updating the self-managed memory strategy.

ModifyStrategyConfiguration

class ModifyStrategyConfiguration

Contains information for modifying a strategy configuration.

NetworkConfiguration

class NetworkConfiguration

SecurityConfig for the Agent.

NetworkMode

sealed class NetworkMode

NumberValidation

class NumberValidation

Validation for NUMBER fields.

NumericalScaleDefinition

class NumericalScaleDefinition

The definition of a numerical rating scale option that provides a numeric value with its description for evaluation scoring.

OAuth2AuthorizationData

class OAuth2AuthorizationData

OAuth2-specific authorization data, including the authorization URL and user identifier for the authorization session.

Oauth2AuthorizationServerMetadata

class Oauth2AuthorizationServerMetadata

Contains the authorization server metadata for an OAuth2 provider.

Oauth2CredentialProviderItem

class Oauth2CredentialProviderItem

Contains information about an OAuth2 credential provider.

Oauth2Discovery

sealed class Oauth2Discovery

Contains the discovery information for an OAuth2 provider.

Oauth2ProviderConfigInput

sealed class Oauth2ProviderConfigInput

Contains the input configuration for an OAuth2 provider.

Oauth2ProviderConfigOutput

sealed class Oauth2ProviderConfigOutput

Contains the output configuration for an OAuth2 provider.

OAuthCredentialProvider

class OAuthCredentialProvider

An OAuth credential provider for gateway authentication. This structure contains the configuration for authenticating with the target endpoint using OAuth.

OAuthGrantType

sealed class OAuthGrantType

OnBehalfOfTokenExchangeConfigType

class OnBehalfOfTokenExchangeConfigType

Configuration for on-behalf-of token exchange.

OnBehalfOfTokenExchangeGrantTypeType

sealed class OnBehalfOfTokenExchangeGrantTypeType

OnlineEvaluationConfigStatus

sealed class OnlineEvaluationConfigStatus

OnlineEvaluationConfigSummary

class OnlineEvaluationConfigSummary

The summary information about an online evaluation configuration, including basic metadata and execution status.

OnlineEvaluationExecutionStatus

sealed class OnlineEvaluationExecutionStatus

OutputConfig

class OutputConfig

The configuration that specifies where evaluation results should be written for monitoring and analysis.

OverrideType

sealed class OverrideType

PaymentConnectorStatus

sealed class PaymentConnectorStatus

PaymentConnectorSummary

class PaymentConnectorSummary

Contains summary information about a payment connector.

PaymentConnectorType

sealed class PaymentConnectorType

PaymentCredentialProviderConfiguration

class PaymentCredentialProviderConfiguration

Configuration for a payment credential provider that stores authentication credentials for a payment provider.

PaymentCredentialProviderItem

class PaymentCredentialProviderItem

Contains summary information about a payment credential provider.

PaymentCredentialProviderVendorType

sealed class PaymentCredentialProviderVendorType

Supported vendor types for payment providers using non-standard auth protocols.

PaymentManagerStatus

sealed class PaymentManagerStatus

PaymentManagerSummary

class PaymentManagerSummary

Contains summary information about a payment manager.

PaymentProviderConfigurationInput

sealed class PaymentProviderConfigurationInput

Provider configuration input — contains secrets for creation and update. Varies by vendor type.

PaymentProviderConfigurationOutput

sealed class PaymentProviderConfigurationOutput

Provider configuration output — no raw secrets, only ARNs. Varies by vendor type.

PaymentsAuthorizerType

sealed class PaymentsAuthorizerType

Policy

class Policy

Represents a complete policy resource within the AgentCore Policy system. Policies are ARN-able resources that contain Cedar policy statements and associated metadata for controlling agent behavior and access decisions. Each policy belongs to a policy engine and defines fine-grained authorization rules that are evaluated in real-time as agents interact with tools through Gateway. Policies use the Cedar policy language to specify who (principals based on OAuth claims like username, role, or scope) can perform what actions (tool calls) on which resources (Gateways), with optional conditions for attribute-based access control. Multiple policies can apply to a single request, with Cedar's forbid-wins semantics ensuring that security restrictions are never accidentally overridden.

PolicyDefinition

sealed class PolicyDefinition

Represents the definition structure for policies within the AgentCore Policy system. This structure encapsulates different policy formats and languages that can be used to define access control rules.

PolicyEngine

class PolicyEngine

Represents a policy engine resource within the AgentCore Policy system. Policy engines serve as containers for grouping related policies and provide the execution context for policy evaluation and management. Each policy engine can be associated with one Gateway (one engine per Gateway), where it intercepts all agent tool calls and evaluates them against the contained policies before allowing tools to execute. The policy engine maintains the Cedar schema generated from the Gateway's tool manifest, ensuring that policies are validated against the actual tools and parameters available. Policy engines support two enforcement modes that can be configured when associating with a Gateway: log-only mode for testing (evaluates decisions without blocking) and enforce mode for production (actively allows or denies based on policy evaluation).

PolicyEngineStatus

sealed class PolicyEngineStatus

PolicyEngineSummary

class PolicyEngineSummary

Represents a metadata-only summary of a policy engine resource. This structure contains resource identifiers, status, and timestamps without customer-encrypted fields such as description or status reasons. Policy engine summaries are returned by operations that do not require access to the customer's KMS key.

PolicyGeneration

class PolicyGeneration

Represents a policy generation request within the AgentCore Policy system. Tracks the AI-powered conversion of natural language descriptions into Cedar policy statements, enabling users to author policies by describing authorization requirements in plain English. The generation process analyzes the natural language input along with the Gateway's tool context and Cedar schema to produce one or more validated policy options. Each generation request tracks the status of the conversion process and maintains findings about the generated policies, including validation results and potential issues. Generated policy assets remain available for one week after successful generation, allowing time to review and create policies from the generated options.

PolicyGenerationAsset

class PolicyGenerationAsset

Represents a generated policy asset from the AI-powered policy generation process within the AgentCore Policy system. Each asset contains a Cedar policy statement generated from natural language input, along with associated metadata and analysis findings to help users evaluate and select the most appropriate policy option.

PolicyGenerationDetails

class PolicyGenerationDetails

Represents the information identifying a generated policy asset from the AI-powered policy generation process within the AgentCore Policy system. Each asset contains a Cedar policy statement generated from natural language input, along with associated metadata and analysis findings to help users evaluate and select the most appropriate policy option.

PolicyGenerationStatus

sealed class PolicyGenerationStatus

PolicyGenerationSummary

class PolicyGenerationSummary

Represents a metadata-only summary of a policy generation resource. This structure contains resource identifiers, status, timestamps, and findings without customer-encrypted fields such as status reasons. Policy generation summaries are returned by operations that do not require access to the customer's KMS key.

PolicyStatus

sealed class PolicyStatus

PolicySummary

class PolicySummary

Represents a metadata-only summary of a policy resource. This structure contains resource identifiers, status, and timestamps without customer-encrypted fields such as definition, description, or status reasons. Policy summaries are returned by operations that do not require access to the customer's KMS key.

PolicyValidationMode

sealed class PolicyValidationMode

PrincipalMatchOperator

sealed class PrincipalMatchOperator

PrivateEndpoint

sealed class PrivateEndpoint

The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC.

PrivateEndpointOverride

class PrivateEndpointOverride

A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration.

ProtocolConfiguration

class ProtocolConfiguration

The protocol configuration for an agent runtime. This structure defines how the agent runtime communicates with clients.

PutResourcePolicyRequest

class PutResourcePolicyRequest

PutResourcePolicyResponse

class PutResourcePolicyResponse

RatingScale

sealed class RatingScale

The rating scale that defines how evaluators should score agent performance, supporting both numerical and categorical scales.

RecordingConfig

class RecordingConfig

The recording configuration for a browser. This structure defines how browser sessions are recorded.

ReflectionConfiguration

sealed class ReflectionConfiguration

Contains reflection configuration information for a memory strategy.

RegistryAuthorizerType

sealed class RegistryAuthorizerType

RegistryRecordCredentialProviderConfiguration

class RegistryRecordCredentialProviderConfiguration

A pairing of a credential provider type with its corresponding provider details for authenticating with external sources.

RegistryRecordCredentialProviderType

sealed class RegistryRecordCredentialProviderType

RegistryRecordCredentialProviderUnion

sealed class RegistryRecordCredentialProviderUnion

Union of supported credential provider types for registry record synchronization.

RegistryRecordIamCredentialProvider

class RegistryRecordIamCredentialProvider

IAM credential provider configuration for authenticating with an external source using SigV4 signing during synchronization.

RegistryRecordOAuthCredentialProvider

class RegistryRecordOAuthCredentialProvider

OAuth credential provider configuration for authenticating with an external source during synchronization.

RegistryRecordOAuthGrantType

sealed class RegistryRecordOAuthGrantType

RegistryRecordStatus

sealed class RegistryRecordStatus

RegistryRecordSummary

class RegistryRecordSummary

Contains summary information about a registry record.

RegistryStatus

sealed class RegistryStatus

RegistrySummary

class RegistrySummary

Contains summary information about a registry.

RequestHeaderConfiguration

sealed class RequestHeaderConfiguration

Configuration for HTTP request headers that will be passed through to the runtime.

Resource

sealed class Resource

Represents a resource within the AgentCore Policy system. Resources are the targets of policy evaluation. Currently, only AgentCore Gateways are supported as resources for policy enforcement.

ResourceLimitExceededException

class ResourceLimitExceededException : BedrockAgentCoreControlException

Exception thrown when a resource limit is exceeded.

ResourceLocation

sealed class ResourceLocation

The location of a resource.

ResourceNotFoundException

class ResourceNotFoundException : BedrockAgentCoreControlException

This exception is thrown when a resource referenced by the operation does not exist

ResourceType

sealed class ResourceType

RestApiMethod

sealed class RestApiMethod

RouteToTargetAction

sealed class RouteToTargetAction

An action that routes requests to a gateway target, either statically or with weighted traffic splitting.

Rule

class Rule

The evaluation rule that defines sampling configuration, filtering criteria, and session detection settings for online evaluation.

RuntimeMetadataConfiguration

class RuntimeMetadataConfiguration

Configuration for microVM metadata service settings.

RuntimeTargetConfiguration

class RuntimeTargetConfiguration

Configuration for an AgentCore Runtime target. Specifies the agent runtime to route requests to via HTTP.

S3Configuration

class S3Configuration

The Amazon S3 configuration for a gateway. This structure defines how the gateway accesses files in Amazon S3.

S3FilesAccessPointConfiguration

class S3FilesAccessPointConfiguration

Configuration for an Amazon S3 Files access point filesystem mounted into the AgentCore Runtime. S3 Files access points provide shared file storage accessible from your AgentCore Runtime sessions.

S3Location

class S3Location

The Amazon S3 location for storing data. This structure defines where in Amazon S3 data is stored.

S3Source

class S3Source

S3 location of a JSONL file containing dataset examples.

SalesforceOauth2ProviderConfigInput

class SalesforceOauth2ProviderConfigInput

Input configuration for a Salesforce OAuth2 provider.

SalesforceOauth2ProviderConfigOutput

class SalesforceOauth2ProviderConfigOutput

Output configuration for a Salesforce OAuth2 provider.

SamplingConfig

class SamplingConfig

The configuration that controls what percentage of agent traces are sampled for evaluation to manage evaluation volume and costs.

SchemaDefinition

class SchemaDefinition

A schema definition for a gateway target. This structure defines the structure of the API that the target exposes.

SchemaType

sealed class SchemaType

SearchType

sealed class SearchType

Secret

class Secret

Contains information about a secret in AWS Secrets Manager.

SecretsManagerLocation

class SecretsManagerLocation

The Amazon Web Services Secrets Manager location configuration.

SelfManagedConfiguration

class SelfManagedConfiguration

A configuration for a self-managed memory strategy.

SelfManagedConfigurationInput

class SelfManagedConfigurationInput

Input configuration for a self-managed memory strategy.

SelfManagedLatticeResource

sealed class SelfManagedLatticeResource

Configuration for a self-managed VPC Lattice resource. You create and manage the VPC Lattice resource gateway and resource configuration, then provide the resource configuration identifier.

SemanticConsolidationOverride

class SemanticConsolidationOverride

Contains semantic consolidation override configuration.

SemanticExtractionOverride

class SemanticExtractionOverride

Contains semantic extraction override configuration.

SemanticMemoryStrategyInput

class SemanticMemoryStrategyInput

Input for creating a semantic memory strategy.

SemanticOverrideConfigurationInput

class SemanticOverrideConfigurationInput

Input for semantic override configuration in a memory strategy.

SemanticOverrideConsolidationConfigurationInput

class SemanticOverrideConsolidationConfigurationInput

Input for semantic override consolidation configuration in a memory strategy.

SemanticOverrideExtractionConfigurationInput

class SemanticOverrideExtractionConfigurationInput

Input for semantic override extraction configuration in a memory strategy.

ServerDefinition

class ServerDefinition

The server definition for an MCP descriptor. Contains the schema version and inline content for the MCP server configuration.

ServerProtocol

sealed class ServerProtocol

ServiceException

class ServiceException : BedrockAgentCoreControlException

An internal error occurred.

ServiceQuotaExceededException

class ServiceQuotaExceededException : BedrockAgentCoreControlException

This exception is thrown when a request is made beyond the service quota

SessionConfig

class SessionConfig

The configuration that defines how agent sessions are detected and when they are considered complete for evaluation.

SessionConfiguration

class SessionConfiguration

The session configuration for an MCP gateway. This structure defines settings that control session behavior.

SessionStorageConfiguration

class SessionStorageConfiguration

Configuration for a session storage filesystem mounted into the AgentCore Runtime. Session storage provides persistent storage that is preserved across AgentCore Runtime session invocations.

SetTokenVaultCmkRequest

class SetTokenVaultCmkRequest

SetTokenVaultCmkResponse

class SetTokenVaultCmkResponse

SkillDefinition

class SkillDefinition

The structured skill definition with schema version and content.

SkillMdDefinition

class SkillMdDefinition

The skill markdown definition for an agent skills descriptor.

SlackOauth2ProviderConfigInput

class SlackOauth2ProviderConfigInput

Input configuration for a Slack OAuth2 provider.

SlackOauth2ProviderConfigOutput

class SlackOauth2ProviderConfigOutput

Output configuration for a Slack OAuth2 provider.

StartPolicyGenerationRequest

class StartPolicyGenerationRequest

StartPolicyGenerationResponse

class StartPolicyGenerationResponse

StaticOverride

class StaticOverride

A static configuration bundle override.

StaticRoute

class StaticRoute

A static route to a single gateway target.

Status

sealed class Status

StrategyConfiguration

class StrategyConfiguration

Contains configuration information for a memory strategy.

StreamDeliveryResource

sealed class StreamDeliveryResource

Supported stream delivery resource types.

StreamDeliveryResources

class StreamDeliveryResources

Configuration for streaming memory record data to external resources.

StreamingConfiguration

class StreamingConfiguration

The streaming configuration for an MCP gateway. This structure defines settings that control response streaming behavior.

StringListValidation

class StringListValidation

Validation for STRINGLIST fields.

StringValidation

class StringValidation

Validation for STRING fields.

StripePrivyConfigurationInput

class StripePrivyConfigurationInput

Stripe Privy configuration — credentials provided by Stripe and Privy.

StripePrivyConfigurationOutput

class StripePrivyConfigurationOutput

Stripe Privy configuration output with secret ARNs.

SubmitRegistryRecordForApprovalRequest

class SubmitRegistryRecordForApprovalRequest

SubmitRegistryRecordForApprovalResponse

class SubmitRegistryRecordForApprovalResponse

SummaryConsolidationOverride

class SummaryConsolidationOverride

Contains summary consolidation override configuration.

SummaryMemoryStrategyInput

class SummaryMemoryStrategyInput

Input for creating a summary memory strategy.

SummaryOverrideConfigurationInput

class SummaryOverrideConfigurationInput

Input for summary override configuration in a memory strategy.

SummaryOverrideConsolidationConfigurationInput

class SummaryOverrideConsolidationConfigurationInput

Input for summary override consolidation configuration in a memory strategy.

SynchronizationConfiguration

class SynchronizationConfiguration

Configuration for synchronizing registry record metadata from an external source.

SynchronizationType

sealed class SynchronizationType

SynchronizeGatewayTargetsRequest

class SynchronizeGatewayTargetsRequest

SynchronizeGatewayTargetsResponse

class SynchronizeGatewayTargetsResponse

SystemManagedBlock

class SystemManagedBlock

System-managed metadata for rules created by automated processes such as A/B tests.

TagResourceRequest

class TagResourceRequest

TagResourceResponse

class TagResourceResponse

TargetConfiguration

sealed class TargetConfiguration

The configuration for a gateway target. This structure defines how the gateway connects to and interacts with the target endpoint.

TargetProtocolType

sealed class TargetProtocolType

TargetStatus

sealed class TargetStatus

TargetSummary

class TargetSummary

Contains summary information about a gateway target. A target represents an endpoint that the gateway can connect to.

TargetTrafficSplitEntry

class TargetTrafficSplitEntry

An entry in a target traffic split configuration.

ThrottledException

class ThrottledException : BedrockAgentCoreControlException

API rate limit has been exceeded.

ThrottlingException

class ThrottlingException : BedrockAgentCoreControlException

This exception is thrown when the number of requests exceeds the limit

TimeBasedTrigger

class TimeBasedTrigger

Trigger configuration based on time.

TimeBasedTriggerInput

class TimeBasedTriggerInput

Trigger configuration based on time.

TokenBasedTrigger

class TokenBasedTrigger

Trigger configuration based on tokens.

TokenBasedTriggerInput

class TokenBasedTriggerInput

Trigger configuration based on tokens.

TokenExchangeGrantTypeConfigType

class TokenExchangeGrantTypeConfigType

Configuration for RFC 8693 token exchange.

ToolDefinition

class ToolDefinition

A tool definition for a gateway target. This structure defines a tool that the target exposes through the Model Context Protocol.

ToolSchema

sealed class ToolSchema

A tool schema for a gateway target. This structure defines the schema for a tool that the target exposes through the Model Context Protocol.

ToolsDefinition

class ToolsDefinition

The tools definition for an MCP descriptor. Contains the protocol version and inline content describing the available tools.

TrafficSplitEntry

class TrafficSplitEntry

An entry in a traffic split configuration, defining a named variant with a weight and configuration bundle reference.

TriggerCondition

sealed class TriggerCondition

Condition that triggers memory processing.

TriggerConditionInput

sealed class TriggerConditionInput

Condition that triggers memory processing.

UnauthorizedException

class UnauthorizedException : BedrockAgentCoreControlException

This exception is thrown when the JWT bearer token is invalid or not found for OAuth bearer token based access

Unit

class Unit

UntagResourceRequest

class UntagResourceRequest

UntagResourceResponse

class UntagResourceResponse

UpdateAgentRuntimeEndpointRequest

class UpdateAgentRuntimeEndpointRequest

UpdateAgentRuntimeEndpointResponse

class UpdateAgentRuntimeEndpointResponse

UpdateAgentRuntimeRequest

class UpdateAgentRuntimeRequest

UpdateAgentRuntimeResponse

class UpdateAgentRuntimeResponse

UpdateApiKeyCredentialProviderRequest

class UpdateApiKeyCredentialProviderRequest

UpdateApiKeyCredentialProviderResponse

class UpdateApiKeyCredentialProviderResponse

UpdateConfigurationBundleRequest

class UpdateConfigurationBundleRequest

UpdateConfigurationBundleResponse

class UpdateConfigurationBundleResponse

UpdatedA2aDescriptor

class UpdatedA2aDescriptor

Wrapper for updating an A2A descriptor with PATCH semantics. When present, the A2A descriptor is replaced with the provided value. When absent, the A2A descriptor is left unchanged. To unset, include the wrapper with the value set to null.

UpdatedAgentSkillsDescriptor

class UpdatedAgentSkillsDescriptor

Wrapper for updating an agent skills descriptor with PATCH semantics. When present with a value, individual fields can be updated independently. When present with a null value, the entire agent skills descriptor is unset. When absent, the agent skills descriptor is left unchanged.

UpdatedAgentSkillsDescriptorFields

class UpdatedAgentSkillsDescriptorFields

Individual agent skills descriptor fields that can be updated independently.

UpdatedApprovalConfiguration

class UpdatedApprovalConfiguration

Wrapper for updating an optional approval configuration field with PATCH semantics. When present in an update request, the approval configuration is replaced with the provided value. When absent, the approval configuration is left unchanged.

UpdateDatasetExamplesRequest

class UpdateDatasetExamplesRequest

UpdateDatasetExamplesResponse

class UpdateDatasetExamplesResponse

UpdateDatasetRequest

class UpdateDatasetRequest

UpdateDatasetResponse

class UpdateDatasetResponse

UpdatedAuthorizerConfiguration

class UpdatedAuthorizerConfiguration

Wrapper for updating an optional AuthorizerConfiguration field with PATCH semantics. When present in an update request, the authorizer configuration is replaced with optionalValue. When absent, the authorizer configuration is left unchanged. To unset, include the wrapper with optionalValue not specified.

UpdatedCustomDescriptor

class UpdatedCustomDescriptor

Wrapper for updating a custom descriptor with PATCH semantics. When present, the custom descriptor is replaced with the provided value. When absent, the custom descriptor is left unchanged. To unset, include the wrapper with the value set to null.

UpdatedDescription

class UpdatedDescription

Wrapper for updating an optional Description field with PATCH semantics. When present in an update request, the description is replaced with optionalValue. When absent, the description is left unchanged. To unset the description, include the wrapper with optionalValue not specified.

UpdatedDescriptors

class UpdatedDescriptors

Wrapper for updating an optional descriptors field with PATCH semantics. When present with a value, individual descriptors can be updated. When present with a null value, all descriptors are unset. When absent, descriptors are left unchanged.

UpdatedDescriptorsUnion

class UpdatedDescriptorsUnion

Contains per-descriptor-type wrappers for updating descriptors. Each descriptor type can be updated independently.

UpdatedHarnessEnvironmentArtifact

class UpdatedHarnessEnvironmentArtifact

Wrapper for updating the environment artifact configuration.

UpdatedHarnessMemoryConfiguration

class UpdatedHarnessMemoryConfiguration

Wrapper for updating the memory configuration.

UpdatedMcpDescriptor

class UpdatedMcpDescriptor

Wrapper for updating an MCP descriptor with PATCH semantics. When present with a value, individual MCP fields can be updated independently. When present with a null value, the entire MCP descriptor is unset. When absent, the MCP descriptor is left unchanged.

UpdatedMcpDescriptorFields

class UpdatedMcpDescriptorFields

Individual MCP descriptor fields that can be updated independently.

UpdatedServerDefinition

class UpdatedServerDefinition

Wrapper for updating a server definition with PATCH semantics. When present, the server definition is replaced with the provided value. When absent, the server definition is left unchanged. To unset, include the wrapper with the value set to null.

UpdatedSkillDefinition

class UpdatedSkillDefinition

Wrapper for updating a skill definition with PATCH semantics.

UpdatedSkillMdDefinition

class UpdatedSkillMdDefinition

Wrapper for updating a skill markdown definition with PATCH semantics.

UpdatedSynchronizationConfiguration

class UpdatedSynchronizationConfiguration

Wrapper for updating the synchronization configuration with PATCH semantics. Must be matched with UpdatedSynchronizationType.

UpdatedSynchronizationType

class UpdatedSynchronizationType

Wrapper for updating the synchronization type with PATCH semantics. Must be matched with UpdatedSynchronizationConfiguration.

UpdatedToolsDefinition

class UpdatedToolsDefinition

Wrapper for updating a tools definition with PATCH semantics. When present, the tools definition is replaced with the provided value. When absent, the tools definition is left unchanged. To unset, include the wrapper with the value set to null.

UpdateEvaluatorRequest

class UpdateEvaluatorRequest

UpdateEvaluatorResponse

class UpdateEvaluatorResponse

UpdateGatewayRequest

class UpdateGatewayRequest

UpdateGatewayResponse

class UpdateGatewayResponse

UpdateGatewayRuleRequest

class UpdateGatewayRuleRequest

UpdateGatewayRuleResponse

class UpdateGatewayRuleResponse