Skip to content

/AWS1/IF_AGW=>CREATEAUTHORIZER()

About CreateAuthorizer

Adds a new Authorizer resource to an existing RestApi resource.

Method Signature

METHODS /AWS1/IF_AGW~CREATEAUTHORIZER
  IMPORTING
    !IV_RESTAPIID TYPE /AWS1/AGWSTRING OPTIONAL
    !IV_NAME TYPE /AWS1/AGWSTRING OPTIONAL
    !IV_TYPE TYPE /AWS1/AGWAUTHORIZERTYPE OPTIONAL
    !IT_PROVIDERARNS TYPE /AWS1/CL_AGWLISTOFARNS_W=>TT_LISTOFARNS OPTIONAL
    !IV_AUTHTYPE TYPE /AWS1/AGWSTRING OPTIONAL
    !IV_AUTHORIZERURI TYPE /AWS1/AGWSTRING OPTIONAL
    !IV_AUTHORIZERCREDENTIALS TYPE /AWS1/AGWSTRING OPTIONAL
    !IV_IDENTITYSOURCE TYPE /AWS1/AGWSTRING OPTIONAL
    !IV_IDENTITYVALIDATIONXPRSN TYPE /AWS1/AGWSTRING OPTIONAL
    !IV_AUTHRRESULTTTLINSECONDS TYPE /AWS1/AGWNULLABLEINTEGER OPTIONAL
  RETURNING
    VALUE(OO_OUTPUT) TYPE REF TO /aws1/cl_agwauthorizer
  RAISING
    /AWS1/CX_AGWBADREQUESTEX
    /AWS1/CX_AGWCONFLICTEXCEPTION
    /AWS1/CX_AGWLIMITEXCEEDEDEX
    /AWS1/CX_AGWNOTFOUNDEXCEPTION
    /AWS1/CX_AGWTOOMANYREQUESTSEX
    /AWS1/CX_AGWUNAUTHORIZEDEX
    /AWS1/CX_AGWCLIENTEXC
    /AWS1/CX_AGWSERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING

Required arguments:

iv_restapiid TYPE /AWS1/AGWSTRING /AWS1/AGWSTRING

The string identifier of the associated RestApi.

iv_name TYPE /AWS1/AGWSTRING /AWS1/AGWSTRING

The name of the authorizer.

iv_type TYPE /AWS1/AGWAUTHORIZERTYPE /AWS1/AGWAUTHORIZERTYPE

The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.

Optional arguments:

it_providerarns TYPE /AWS1/CL_AGWLISTOFARNS_W=>TT_LISTOFARNS TT_LISTOFARNS

A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}. For a TOKEN or REQUEST authorizer, this is not defined.

iv_authtype TYPE /AWS1/AGWSTRING /AWS1/AGWSTRING

Optional customer-defined field, used in OpenAPI imports and exports without functional impact.

iv_authorizeruri TYPE /AWS1/AGWSTRING /AWS1/AGWSTRING

Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations. In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api}, where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial /. For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations.

iv_authorizercredentials TYPE /AWS1/AGWSTRING /AWS1/AGWSTRING

Specifies the required credentials as an IAM role for API Gateway to invoke the authorizer. To specify an IAM role for API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.

iv_identitysource TYPE /AWS1/AGWSTRING /AWS1/AGWSTRING

The identity source for which authorization is requested. For a TOKEN or COGNITO_USER_POOLS authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth, the header mapping expression is method.request.header.Auth. For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name. These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.

iv_identityvalidationxprsn TYPE /AWS1/AGWSTRING /AWS1/AGWSTRING

A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. For COGNITO_USER_POOLS authorizers, API Gateway will match the aud field of the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function when there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.

iv_authrresultttlinseconds TYPE /AWS1/AGWNULLABLEINTEGER /AWS1/AGWNULLABLEINTEGER

The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.

RETURNING

oo_output TYPE REF TO /aws1/cl_agwauthorizer /AWS1/CL_AGWAUTHORIZER

Domain /AWS1/RT_ACCOUNT_ID
Primitive Type NUMC

Examples

Syntax Example

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->createauthorizer(
  it_providerarns = VALUE /aws1/cl_agwlistofarns_w=>tt_listofarns(
    ( new /aws1/cl_agwlistofarns_w( |string| ) )
  )
  iv_authorizercredentials = |string|
  iv_authorizeruri = |string|
  iv_authrresultttlinseconds = 123
  iv_authtype = |string|
  iv_identitysource = |string|
  iv_identityvalidationxprsn = |string|
  iv_name = |string|
  iv_restapiid = |string|
  iv_type = |string|
).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
  lv_string = lo_result->get_id( ).
  lv_string = lo_result->get_name( ).
  lv_authorizertype = lo_result->get_type( ).
  LOOP AT lo_result->get_providerarns( ) into lo_row.
    lo_row_1 = lo_row.
    IF lo_row_1 IS NOT INITIAL.
      lv_providerarn = lo_row_1->get_value( ).
    ENDIF.
  ENDLOOP.
  lv_string = lo_result->get_authtype( ).
  lv_string = lo_result->get_authorizeruri( ).
  lv_string = lo_result->get_authorizercredentials( ).
  lv_string = lo_result->get_identitysource( ).
  lv_string = lo_result->get_identityvalidationxprsn( ).
  lv_nullableinteger = lo_result->get_authrresultttlinseconds( ).
ENDIF.