The organization under which the resource exists.

The resource for which members (users or groups) are associated.

The member (user or group) to associate to the resource.

The response's http status code.

The organization under which the group exists.

The group to which the member (user or group) is associated.

The member (user or group) to associate to the group.

The response's http status code.

The WorkMail organization under which the impersonation role will be assumed.

The impersonation role ID to assume.

The authentication token's validity, in seconds.

The authentication token for the impersonation role.

The response's http status code.

The idempotency token for the client request.

The job ID.

The organization ID.

The response's http status code.

The organization under which the member (user or group) exists.

The member (user or group) to which this alias is added.

The alias to add to the member set.

The response's http status code.

An idempotent token that ensures that an API request is executed only once.

Exchange Web Services (EWS) availability provider definition. The request must contain exactly one provider definition, either EwsProvider or LambdaProvider.

Lambda availability provider definition. The request must contain exactly one provider definition, either EwsProvider or LambdaProvider.

The WorkMail organization for which the AvailabilityConfiguration will be created.

The domain to which the provider applies.

The response's http status code.

The organization under which the group is to be created.

The name of the group.

The identifier of the group.

The response's http status code.

The idempotency token for the client request.

The description of the new impersonation role.

The WorkMail organization to create the new impersonation role within.

The name of the new impersonation role.

The impersonation role's type. The available impersonation role types are READ_ONLY or FULL_ACCESS.

The list of rules for the impersonation role.

The new impersonation role ID.

The response's http status code.

The idempotency token for the client request.

The rule description.

Device models that the rule will match.

Device operating systems that the rule will match.

Device types that the rule will match.

Device user agents that the rule will match.

Device models that the rule will not match. All other device models will match.

Device operating systems that the rule will not match. All other device operating systems will match.

Device types that the rule will not match. All other device types will match.

Device user agents that the rule will not match. All other device user agents will match.

The WorkMail organization under which the rule will be created.

The rule name.

The effect of the rule when it matches. Allowed values are ALLOW or DENY.

The identifier for the newly created mobile device access rule.

The response's http status code.

The idempotency token associated with the request.

The AWS Directory Service directory ID.

The email domains to associate with the organization.

When true, allows organization interoperability between WorkMail and Microsoft Exchange. If true, you must include a AD Connector directory ID in the request.

The Amazon Resource Name (ARN) of a customer managed key from AWS KMS.

The organization alias.

The organization ID.

The response's http status code.

The identifier associated with the organization for which the resource is created.

The name of the new resource.

The type of the new resource. The available types are equipment and room.

The identifier of the new resource.

The response's http status code.

The identifier of the organization for which the user is created.

The name for the new user. WorkMail directory user names have a maximum length of 64. All others have a maximum length of 20.

The display name for the new user.

The password for the new user.

The identifier for the new user.

The response's http status code.

The identifier for the organization.

The name of the access control rule.

The response's http status code.

The identifier for the organization under which the user exists.

The identifier for the member (user or group) from which to have the aliases removed.

The aliases to be removed from the user's set of aliases. Duplicate entries in the list are collapsed into single entries (the list is transformed into a set).

The response's http status code.

The WorkMail organization for which the AvailabilityConfiguration will be deleted.

The domain for which the AvailabilityConfiguration will be deleted.

The response's http status code.

The ID of the organization from which the email monitoring configuration is deleted.

The response's http status code.

The organization that contains the group.

The identifier of the group to be deleted.

The response's http status code.

The WorkMail organization from which to delete the impersonation role.

The ID of the impersonation role to delete.

The response's http status code.

The identifier of the organization under which the member (user or group) exists.

The identifier of the member (user or group) that owns the mailbox.

The identifier of the member (user or group) for which to delete granted permissions.

The response's http status code.

The WorkMail organization for which the access override will be deleted.

The WorkMail user for which you want to delete the override. Accepts the following types of user identities:

• User ID: 12345678-1234-1234-1234-123456789012 or S-1-1-12-1234567890-123456789-123456789-1234
• Email address: user@domain.tld
• User name: user

The mobile device for which you delete the override. DeviceId is case insensitive.

The response's http status code.

The WorkMail organization under which the rule will be deleted.

The identifier of the rule to be deleted.

The response's http status code.

The idempotency token associated with the request.

The organization ID.

If true, deletes the AWS Directory Service directory associated with the organization.

The organization ID.

The state of the organization.

The response's http status code.

The identifier associated with the organization from which the resource is deleted.

The identifier of the resource to be deleted.

The response's http status code.

The organization ID.

The retention policy ID.

The response's http status code.

The organization that contains the user to be deleted.

The identifier of the user to be deleted.

The response's http status code.

The identifier for the organization under which the WorkMail entity exists.

The identifier for the member (user or group) to be updated.

The response's http status code.

The WorkMail organization for which the domain will be deregistered.

The domain to deregister in WorkMail and SES.

The response's http status code.

The ID of the organization for which the email monitoring configuration is described.

The Amazon Resource Name (ARN) of the CloudWatch Log group associated with the email monitoring configuration.

The Amazon Resource Name (ARN) of the IAM Role associated with the email monitoring configuration.

The response's http status code.

The identifier for the organization under which the group exists.

The identifier for the group to be described.

The date and time when a user was deregistered from WorkMail, in UNIX epoch time format.

The email of the described group.

The date and time when a user was registered to WorkMail, in UNIX epoch time format.

The identifier of the described group.

The name of the described group.

The state of the user: enabled (registered to WorkMail) or disabled (deregistered or never registered to WorkMail).

The response's http status code.

Lists the ID of the given organization.

Lists the enforcement setting of the applied policy.

The response's http status code.

The mailbox export job ID.

The organization ID.

The mailbox export job description.

The mailbox export job end timestamp.

The identifier of the user or resource associated with the mailbox.

Error information for failed mailbox export jobs.

The estimated progress of the mailbox export job, in percentage points.

The Amazon Resource Name (ARN) of the symmetric AWS Key Management Service (AWS KMS) key that encrypts the exported mailbox content.

The ARN of the AWS Identity and Access Management (IAM) role that grants write permission to the Amazon Simple Storage Service (Amazon S3) bucket.

The name of the S3 bucket.

The path to the S3 bucket and file that the mailbox export job is exporting to.

The S3 bucket prefix.

The mailbox export job start timestamp.

The state of the mailbox export job.

The response's http status code.

The identifier for the organization to be described.

The Amazon Resource Name (ARN) of the organization.

The alias for an organization.

The date at which the organization became usable in the WorkMail context, in UNIX epoch time format.

The default mail domain associated with the organization.

The identifier for the directory associated with an WorkMail organization.

The type of directory associated with the WorkMail organization.

(Optional) The error message indicating if unexpected behavior was encountered with regards to the organization.

The identifier of an organization.

The state of an organization.

The response's http status code.

The identifier associated with the organization for which the resource is described.

The identifier of the resource to be described.

The booking options for the described resource.

The date and time when a resource was disabled from WorkMail, in UNIX epoch time format.

The email of the described resource.

The date and time when a resource was enabled for WorkMail, in UNIX epoch time format.

The name of the described resource.

The identifier of the described resource.

The state of the resource: enabled (registered to WorkMail), disabled (deregistered or never registered to WorkMail), or deleted.

The type of the described resource.

The response's http status code.

The identifier for the organization under which the user exists.

The identifier for the user to be described.

The date and time at which the user was disabled for WorkMail usage, in UNIX epoch time format.

The display name of the user.

The email of the user.

The date and time at which the user was enabled for WorkMailusage, in UNIX epoch time format.

The name for the user.

The state of a user: enabled (registered to WorkMail) or disabled (deregistered or never registered to WorkMail).

The identifier for the described user.

In certain cases, other entities are modeled as users. If interoperability is enabled, resources are imported into WorkMail as users. Because different WorkMail organizations rely on different directory types, administrators can distinguish between an unregistered user (account is disabled and has a user role) and the directory administrators. The values are USER, RESOURCE, and SYSTEM_USER.

The response's http status code.

The identifier for the organization under which the resource exists.

The identifier of the resource from which delegates' set members are removed.

The identifier for the member (user, group) to be removed from the resource's delegates.

The response's http status code.

The identifier for the organization under which the group exists.

The identifier for the group from which members are removed.

The identifier for the member to be removed to the group.

The response's http status code.

The impersonation role ID.

The user ID.

The identifier for the organization.

The IPv4 address.

The access protocol action. Valid values include ActiveSync, AutoDiscover, EWS, IMAP, SMTP, WindowsOutlook, and WebMail.

The rule effect.

The rules that match the given parameters, resulting in an effect.

The response's http status code.

The organization ID.

The retention policy description.

The retention policy folder configurations.

The retention policy ID.

The retention policy name.

The response's http status code.

The WorkMail organization from which to retrieve the impersonation role.

The impersonation role ID to retrieve.

The date when the impersonation role was created.

The date when the impersonation role was last modified.

The impersonation role description.

The impersonation role ID.

The impersonation role name.

The list of rules for the given impersonation role.

The impersonation role type.

The response's http status code.

The WorkMail organization where the impersonation role is defined.

The impersonation role ID to test.

The WorkMail organization user chosen to test the impersonation role. The following identity formats are available:

• User ID: 12345678-1234-1234-1234-123456789012 or S-1-1-12-1234567890-123456789-123456789-1234
• Email address: user@domain.tld
• User name: user

Effect of the impersonation role on the target user based on its rules. Available effects are ALLOW or DENY.

A list of the rules that match the input and produce the configured effect.

The impersonation role type.

The response's http status code.

The WorkMail organization for which the domain is retrieved.

The domain from which you want to retrieve details.

Indicates the status of a DKIM verification.

Specifies whether the domain is the default domain for your organization.

Specifies whether the domain is a test domain provided by WorkMail, or a custom domain.

Indicates the status of the domain ownership verification.

A list of the DNS records that WorkMail recommends adding in your DNS provider for the best user experience. The records configure your domain with DMARC, SPF, DKIM, and direct incoming email traffic to SES. See admin guide for more details.

The response's http status code.

The identifier for the organization that contains the user whose mailbox details are being requested.

The identifier for the user whose mailbox details are being requested.

The maximum allowed mailbox size, in MB, for the specified user.

The current mailbox size, in MB, for the specified user.

The response's http status code.

Device model the simulated user will report.

Device operating system the simulated user will report.

Device type the simulated user will report.

Device user agent the simulated user will report.

The WorkMail organization to simulate the access effect for.

The effect of the simulated access, ALLOW or DENY, after evaluating mobile device access rules in the WorkMail organization for the simulated user parameters.

A list of the rules which matched the simulated user input and produced the effect.

The response's http status code.

The WorkMail organization to which you want to apply the override.

Identifies the WorkMail user for the override. Accepts the following types of user identities:

• User ID: 12345678-1234-1234-1234-123456789012 or S-1-1-12-1234567890-123456789-123456789-1234
• Email address: user@domain.tld
• User name: user

The mobile device to which the override applies. DeviceId is case insensitive.

The date the override was first created.

The date the description was last modified.

A description of the override.

The device to which the access override applies.

The effect of the override, ALLOW or DENY.

The WorkMail user to which the access override applies.

The response's http status code.

The identifier for the organization.

The access control rules.

The response's http status code.

The maximum number of results to return in a single call.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The identifier for the organization under which the entity exists.

The identifier for the entity for which to list the aliases.

The entity's paginated aliases.

The token to use to retrieve the next page of results. The value is "null" when there are no more results to return.

The response's http status code.

The maximum number of results to return in a single call.

The token to use to retrieve the next page of results. The first call does not require a token.

The WorkMail organization for which the AvailabilityConfiguration's will be listed.

The list of AvailabilityConfiguration's that exist for the specified WorkMail organization.

The token to use to retrieve the next page of results. The value is null when there are no further results to return.

The response's http status code.

The maximum number of results to return in a single call.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The identifier for the organization under which the group exists.

The identifier for the group to which the members (users or groups) are associated.

The members associated to the group.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The response's http status code.

The maximum number of results to return in a single call.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The identifier for the organization under which the groups exist.

The overview of groups for an organization.

The token to use to retrieve the next page of results. The value is "null" when there are no more results to return.

The response's http status code.

The maximum number of results returned in a single call.

The token used to retrieve the next page of results. The first call doesn't require a token.

The WorkMail organization to which the listed impersonation roles belong.

The token to retrieve the next page of results. The value is null when there are no results to return.

The list of impersonation roles under the given WorkMail organization.

The response's http status code.

The maximum number of results to return in a single call.

The token to use to retrieve the next page of results. The first call does not require a token.

The WorkMail organization for which to list domains.

The list of mail domain summaries, specifying domains that exist in the specified WorkMail organization, along with the information about whether the domain is or isn't the default.

The token to use to retrieve the next page of results. The value becomes null when there are no more results to return.

The response's http status code.

The maximum number of results to return in a single call.

The token to use to retrieve the next page of results.

The organization ID.

The mailbox export job details.

The token to use to retrieve the next page of results.

The response's http status code.

The maximum number of results to return in a single call.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The identifier of the organization under which the user, group, or resource exists.

The identifier of the user, group, or resource for which to list mailbox permissions.

The token to use to retrieve the next page of results. The value is "null" when there are no more results to return.

One page of the user, group, or resource mailbox permissions.

The response's http status code.

The mobile device to which the access override applies.

The maximum number of results to return in a single call.

The token to use to retrieve the next page of results. The first call does not require a token.

The WorkMail user under which you list the mobile device access overrides. Accepts the following types of user identities:

• User ID: 12345678-1234-1234-1234-123456789012 or S-1-1-12-1234567890-123456789-123456789-1234
• Email address: user@domain.tld
• User name: user

The WorkMail organization under which to list mobile device access overrides.

The token to use to retrieve the next page of results. The value is “null” when there are no more results to return.

The list of mobile device access overrides that exist for the specified WorkMail organization and user.

The response's http status code.

The WorkMail organization for which to list the rules.

The list of mobile device access rules that exist under the specified WorkMail organization.

The response's http status code.

The maximum number of results to return in a single call.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The token to use to retrieve the next page of results. The value is "null" when there are no more results to return.

The overview of owned organizations presented as a list of organization summaries.

The response's http status code.

The number of maximum results in a page.

The token used to paginate through the delegates associated with a resource.

The identifier for the organization that contains the resource for which delegates are listed.

The identifier for the resource whose delegates are listed.

One page of the resource's delegates.

The token used to paginate through the delegates associated with a resource. While results are still available, it has an associated value. When the last page is reached, the token is empty.

The response's http status code.

The maximum number of results to return in a single call.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The identifier for the organization under which the resources exist.

The token used to paginate through all the organization's resources. While results are still available, it has an associated value. When the last page is reached, the token is empty.

One page of the organization's resource representation.

The response's http status code.

The resource ARN.

A list of tag key-value pairs.

The response's http status code.

The maximum number of results to return in a single call.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The identifier for the organization under which the users exist.

The token to use to retrieve the next page of results. This value is `null` when there are no more results to return.

The overview of users for an organization.

The response's http status code.

Access protocol actions to include in the rule. Valid values include ActiveSync, AutoDiscover, EWS, IMAP, SMTP, WindowsOutlook, and WebMail.

Impersonation role IDs to include in the rule.

IPv4 CIDR ranges to include in the rule.

Access protocol actions to exclude from the rule. Valid values include ActiveSync, AutoDiscover, EWS, IMAP, SMTP, WindowsOutlook, and WebMail.

Impersonation role IDs to exclude from the rule.

IPv4 CIDR ranges to exclude from the rule.

User IDs to exclude from the rule.

User IDs to include in the rule.

The rule name.

The rule effect.

The rule description.

The identifier of the organization.

The response's http status code.

The ID of the organization for which the email monitoring configuration is set.

The Amazon Resource Name (ARN) of the IAM Role associated with the email monitoring configuration.

The Amazon Resource Name (ARN) of the CloudWatch Log group associated with the email monitoring configuration.

The response's http status code.

The ID of the organization that you are applying the DMARC policy to.

Enforces or suspends a policy after it's applied.

The response's http status code.

The identifier of the organization under which the user, group, or resource exists.

The identifier of the user, group, or resource for which to update mailbox permissions.

The identifier of the user, group, or resource to which to grant the permissions.

The permissions granted to the grantee. SEND_AS allows the grantee to send email as the owner of the mailbox (the grantee is not mentioned on these emails). SEND_ON_BEHALF allows the grantee to send email on behalf of the owner of the mailbox (the grantee is not mentioned as the physical sender of these emails). FULL_ACCESS allows the grantee full access to the mailbox, irrespective of other folder-level permissions set on the mailbox.

The response's http status code.

A description of the override.

Identifies the WorkMail organization for which you create the override.

The WorkMail user for which you create the override. Accepts the following types of user identities:

• User ID: 12345678-1234-1234-1234-123456789012 or S-1-1-12-1234567890-123456789-123456789-1234
• Email address: user@domain.tld
• User name: user

The mobile device for which you create the override. DeviceId is case insensitive.

The effect of the override, ALLOW or DENY.

The response's http status code.

The retention policy description.

The retention policy ID.

The organization ID.

The retention policy name.

The retention policy folder configurations.

The response's http status code.

Idempotency token used when retrying requests.

The WorkMail organization under which you're creating the domain.

The name of the mail domain to create in WorkMail and SES.

The response's http status code.

The identifier for the organization under which the user, group, or resource exists.

The identifier for the user, group, or resource to be updated.

The email for the user, group, or resource to be updated.

The response's http status code.

The identifier of the organization that contains the user for which the password is reset.

The identifier of the user for whom the password is reset.

The new password for the user.

The response's http status code.

The mailbox export job description.

The idempotency token for the client request.

The identifier associated with the organization.

The identifier of the user or resource associated with the mailbox.

The ARN of the AWS Identity and Access Management (IAM) role that grants write permission to the S3 bucket.

The Amazon Resource Name (ARN) of the symmetric AWS Key Management Service (AWS KMS) key that encrypts the exported mailbox content.

The name of the S3 bucket.