> ## Documentation Index
> Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Barndoor's AWS principal for role-assumption trust policies



## OpenAPI

````yaml /api-reference/openapi.yaml get /api/llm-gateway/admin/connections/aws-role-config
openapi: 3.1.0
info:
  title: Barndoor.ai Public API
  description: Unified public API specification for Barndoor.ai platform
  version: 2.18.0
servers:
  - url: https://{host}
    description: Barndoor public API
    variables:
      host:
        default: platform.barndoor.ai
        description: >-
          The host serving your Barndoor deployment. Defaults to production;
          override it for another environment or a dedicated deployment.
security:
  - ApiKey: []
  - OAuth2:
      - openid
      - profile
      - email
tags:
  - name: dlp
    x-group: Data Control Center
  - name: identity
    x-group: Identity
  - name: llm-gateway
    x-group: LLM Gateway
  - name: notification
    x-group: Notifications
  - name: policy
    x-group: Policies
  - name: registry
    x-group: MCP Gateway
  - name: system-management
    x-group: Log Exports
paths:
  /api/llm-gateway/admin/connections/aws-role-config:
    get:
      tags:
        - llm-gateway
      summary: Get Barndoor's AWS principal for role-assumption trust policies
      operationId: aws_role_config
      responses:
        '200':
          description: The requested record
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LlmGatewayAwsRoleConfigResponse'
        '401':
          description: Missing or invalid credentials
        '403':
          description: Caller is not permitted to act on this resource in this organization
components:
  schemas:
    LlmGatewayAwsRoleConfigResponse:
      type: object
      description: >-
        Whether Barndoor's own AWS principal is configured for role-assumption

        trust policies.


        Named with the service prefix because dlp-service publishes a type of
        the

        same shape under the unprefixed name, and the merged document has ONE
        global

        component namespace. The generator fails closed on two services defining
        the

        same referenced component differently, which is how this was caught.
        Making

        the two byte-identical instead would silently couple two services'
        schemas

        and turn any later divergence into a hard failure of the whole spec.
      required:
        - configured
      properties:
        configured:
          type: boolean
          description: >-
            True when Barndoor has a principal ARN to put in a customer trust
            policy.
        principal_arn:
          type:
            - string
            - 'null'
          description: >-
            The ARN customers name as the trusted principal; null when
            unconfigured.
  securitySchemes:
    ApiKey:
      type: http
      scheme: bearer
      description: >-
        A Barndoor API key, sent as `Authorization: Bearer <key>`. Keys are
        prefixed `bdai_` and are opaque — do not attempt to decode one.
        Interchangeable with an OAuth 2.0 access token.
    OAuth2:
      type: oauth2
      x-issuer: https://auth.barndoor.ai/realms/barndoor
      description: >-
        An OAuth 2.0 access token from Barndoor's identity provider, sent as
        `Authorization: Bearer <token>`. Public clients must use PKCE.
        Interchangeable with an API key.
      flows:
        authorizationCode:
          authorizationUrl: >-
            https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/auth
          tokenUrl: >-
            https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token
          scopes:
            openid: Issue an OIDC ID token identifying the caller.
            profile: Read the caller's basic profile claims.
            email: Read the caller's email address.
            offline_access: Issue a refresh token. Optional — no operation requires it.
        clientCredentials:
          tokenUrl: >-
            https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token
          scopes:
            openid: Issue an OIDC ID token identifying the caller.
            profile: Read the caller's basic profile claims.
            email: Read the caller's email address.
            offline_access: Issue a refresh token. Optional — no operation requires it.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.