# Create the upload role

`PUT https://api-vod-express.syncwords.com/v1/account/aws-access`

Create the upload role

Creates your account’s IAM role, trusting the AWS principal you name. Repeating the call with the same principal changes nothing; another principal re-points the same role, and the external id stays. Only an administrator of your organization, or its API key, may call it.

**Guide:** [Upload with the AWS CLI](/vod-express/uploads/aws-role)

## Request body

Example:

```json
{
  "iamPrincipalArn": "arn:aws:iam::444455556666:role/uploader"
}
```

Schema:

```json
{
  "type": "object",
  "required": [
    "iamPrincipalArn"
  ],
  "additionalProperties": false,
  "properties": {
    "iamPrincipalArn": {
      "type": "string",
      "description": "The AWS identity that will assume the role: a role or user ARN, or a 12-digit account id.",
      "examples": [
        "arn:aws:iam::444455556666:role/uploader",
        "444455556666"
      ]
    }
  }
}
```

## Responses

### 200

OK

Example:

```json
{
  "data": {
    "iamPrincipalArn": "arn:aws:iam::444455556666:role/uploader",
    "roleArn": "arn:aws:iam::710713970991:role/sw-vod-express-vended-upload-141",
    "externalId": "5f0c1d2e-8a4b-4c6d-9e7f-0a1b2c3d4e5f",
    "bucket": "sw-vod-express",
    "region": "us-east-1",
    "s3Prefix": "s3://sw-vod-express/projects/141/"
  }
}
```

Schema:

```json
{
  "type": "object",
  "required": [
    "data"
  ],
  "properties": {
    "data": {
      "$ref": "#/components/schemas/AwsAccess"
    }
  }
}
```

### 401

No token, or an expired or unknown one: `unauthenticated`.

Example:

```json
{
  "message": "Unauthenticated.",
  "code": "unauthenticated"
}
```

Schema:

```json
{
  "$ref": "#/components/schemas/Error"
}
```

### 403

Not available to the account (`vod_express_not_enabled`, `account_restricted`), or a user who is not an administrator of the organization (`forbidden`).

Example:

```json
{
  "message": [
    "Only an administrator of the organization, or its API key, may change its AWS access."
  ],
  "code": "forbidden"
}
```

Schema:

```json
{
  "$ref": "#/components/schemas/Error"
}
```

### 413

The body is over 2 MB: `payload_too_large`.

Example:

```json
{
  "message": [
    "The request body is too large."
  ],
  "code": "payload_too_large"
}
```

Schema:

```json
{
  "$ref": "#/components/schemas/Error"
}
```

### 415

The body is neither JSON nor YAML: `unsupported_media_type`.

Example:

```json
{
  "message": [
    "Send the body as JSON (Content-Type: application/json) or YAML (Content-Type: application/yaml)."
  ],
  "code": "unsupported_media_type"
}
```

Schema:

```json
{
  "$ref": "#/components/schemas/Error"
}
```

### 422

Not an IAM principal: `validation_failed`.

Schema:

```json
{
  "$ref": "#/components/schemas/Error"
}
```

### 429

Rate limited: `too_many_requests`. Wait the seconds `Retry-After` says, then repeat the call.

Example:

```json
{
  "message": [
    "Too Many Attempts."
  ],
  "code": "too_many_requests"
}
```

Schema:

```json
{
  "$ref": "#/components/schemas/Error"
}
```

### 502

AWS refused a step: `aws_access_failed`. Repeat the call.

Schema:

```json
{
  "$ref": "#/components/schemas/Error"
}
```

### 503

Upload roles are not available in this environment: `service_unavailable`.

Schema:

```json
{
  "$ref": "#/components/schemas/Error"
}
```

## Schemas

### AwsAccess

`#/components/schemas/AwsAccess`

```json
{
  "type": "object",
  "required": [
    "iamPrincipalArn",
    "roleArn",
    "externalId",
    "bucket",
    "region",
    "s3Prefix"
  ],
  "properties": {
    "iamPrincipalArn": {
      "type": "string",
      "description": "The principal the role trusts."
    },
    "roleArn": {
      "type": "string",
      "description": "Assume this role …"
    },
    "externalId": {
      "type": "string",
      "description": "… with this external id."
    },
    "bucket": {
      "type": "string"
    },
    "region": {
      "type": "string"
    },
    "s3Prefix": {
      "type": "string",
      "description": "Everything the role reaches: your account’s folder, one subfolder a project."
    }
  }
}
```

### Error

`#/components/schemas/Error`

```json
{
  "type": "object",
  "required": [
    "message",
    "code"
  ],
  "properties": {
    "message": {
      "description": "For people. A string, or an array of one string on some statuses: read it as `Array.isArray(m) ? m[0] : m`.",
      "oneOf": [
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      ]
    },
    "code": {
      "description": "For programs: stable, one per situation. See the Errors guide.",
      "enum": [
        "bad_request",
        "invalid_output_path",
        "invalid_idempotency_key",
        "unauthenticated",
        "invalid_credentials",
        "forbidden",
        "vod_express_not_enabled",
        "account_restricted",
        "not_found",
        "project_not_found",
        "file_not_found",
        "file_meta_not_found",
        "output_not_found",
        "feed_not_found",
        "upload_not_found",
        "webhook_not_found",
        "webhook_delivery_not_found",
        "aws_access_not_provisioned",
        "storage_connection_not_found",
        "method_not_allowed",
        "conflict",
        "file_exists",
        "project_reads_feed",
        "project_reads_folder",
        "file_processing",
        "project_config_locked",
        "idempotency_in_progress",
        "storage_connection_in_use",
        "payload_too_large",
        "unsupported_media_type",
        "validation_failed",
        "service_start_failed",
        "idempotency_key_reused",
        "webhook_limit_reached",
        "storage_failed",
        "storage_connection_check_failed",
        "storage_connection_folder_only",
        "storage_prefix_taken",
        "build_without_storage_connections",
        "build_has_no_schema",
        "too_many_requests",
        "internal_error",
        "bad_gateway",
        "service_stop_failed",
        "aws_access_failed",
        "platform_unavailable",
        "service_unavailable",
        "build_list_unavailable"
      ]
    },
    "errors": {
      "type": "object",
      "description": "On a 422: each field’s messages, keyed by field name, or by JSON pointer inside `config`.",
      "additionalProperties": {
        "type": "array",
        "items": {
          "type": "string"
        }
      }
    }
  }
}
```