AWS Amazon CloudDirectory
Browse all AWS APIs★ Only Publicly Available OpenAPI DocumentIdentity AuthDirectory ServicesapiKey66 EndpointsREST
For Agents
Define schemas, create directories, and manage hierarchical or graph-based objects, attributes, and typed links for application directory data such as device fleets, org charts, and policy graphs.
Use for: I need to create a new Cloud Directory schema, Create a directory from a published schema, Attach an object as a child of another object, Run a batch read across many objects
Not supported: Does not authenticate end users, host LDAP or Active Directory, or store SSO sessions. Use for application-layer hierarchical and graph directory data only.
Amazon Cloud Directory is a fully managed, hierarchical and graph-based directory store that scales to hundreds of millions of objects. The API lets you define one or more schemas with object facets and typed-link facets, create directories from those schemas, attach and detach objects in parent-child or graph relationships, build indexes for fast lookup, and run BatchRead and BatchWrite for high-throughput composite operations. Common uses include device registries, organisational hierarchies, course catalogs, network topologies, and policy graphs that need richer relationships than a flat user directory.
Install Jentic One Beta
Connect the Amazon CloudDirectory to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Amazon CloudDirectory, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Amazon CloudDirectory API.
Create development, published, and applied schemas with object facets, attributes, and typed-link facets
Create directories backed by an applied schema and tag them for organisation
Attach and detach objects in parent-child or arbitrary typed-link relationships, supporting tree and graph models
Run BatchRead to fetch many object attributes and lookups in a single request
Run BatchWrite to apply many creates, updates, and attaches atomically
Build and query indexes for fast attribute-based object lookup
Apply and detach policies on objects for hierarchical authorisation patterns
Use Cases
Patterns agents use Amazon CloudDirectory API for, with concrete tasks.
★ Device Fleet Hierarchy
Model a fleet of IoT devices grouped by site, building, and floor without forcing the relationships into a relational schema. Define a schema with Device, Floor, Building, and Site facets, create the directory, and attach Device objects under their Floor under Building under Site. Cloud Directory's hierarchy operations let you fetch all devices in a building in a single call, regardless of fleet size.
CreateDirectory from schemaArn=arn:aws:clouddirectory:...:schema/published/DeviceFleet/1.0, then AttachObject linking each Device object under its Floor parent in BatchWrite blocks of 20.
Organisational Chart with Policy Inheritance
Store an organisational chart with policy inheritance, so that granting a permission at the Engineering level applies to every team and person under it. Use Cloud Directory's policy facets, AttachPolicy at the desired node, and LookupPolicy at the leaf to retrieve the effective set. This is the same pattern AWS Organizations uses for SCPs and matches how IAM access often needs to flow in regulated organisations.
AttachPolicy with PolicyReference pointing at object /Engineering and ObjectReference at the policy object, then call LookupPolicy at /Engineering/Platform/jane.doe to confirm inheritance.
Indexed Attribute Lookup
Find an object by an attribute (serial number, email, IP address) in milliseconds rather than walking the hierarchy. CreateIndex on a facet attribute, AttachToIndex for each object that should be discoverable, then ListIndex to query by attribute value. Useful for any domain where users will search by an identifier rather than navigate a tree.
CreateIndex with OrderedIndexedAttributeList=[{FacetName: Device, Name: serialNumber}], then AttachToIndex for each Device, then ListIndex with RangesOnIndexedValues to query by serial number prefix.
Agent-Driven Directory Operator
Let an agent reconcile a directory with an external source of truth (a CMDB, an HR system, an MQTT registry) by streaming differences into BatchWrite calls. The agent calls Cloud Directory through Jentic so AWS credentials never leave the vault and the same reconciliation logic runs across multiple directories.
Search Jentic for 'batch write to a Cloud Directory', execute it with operations=[{CreateObject: ...}, {AttachObject: ...}] derived from the diff between the source system and ListObjectChildren on each affected parent.
Key Endpoints
66 endpoints — amazon cloud directory is a fully managed, hierarchical and graph-based directory store that scales to hundreds of millions of objects.
METHOD
PATH
DESCRIPTION
PUT
/amazonclouddirectory/2017-01-11/directory/create#x-amz-data-partition
Create a directory from a published schema
PUT
/amazonclouddirectory/2017-01-11/object#x-amz-data-partition
Create an object in a directory
PUT
/amazonclouddirectory/2017-01-11/object/attach#x-amz-data-partition
Attach an object as a child of another object
POST
/amazonclouddirectory/2017-01-11/batchread#x-amz-data-partition
Run a batch read
PUT
/amazonclouddirectory/2017-01-11/batchwrite#x-amz-data-partition
Run a batch write
PUT
/amazonclouddirectory/2017-01-11/index#x-amz-data-partition
Create an index on a facet attribute
PUT
/amazonclouddirectory/2017-01-11/policy/attach#x-amz-data-partition
Attach a policy to an object
PUT
/amazonclouddirectory/2017-01-11/typedlink/attach#x-amz-data-partition
Attach a typed link between two objects
PUT
/amazonclouddirectory/2017-01-11/directory/create#x-amz-data-partition
Create a directory from a published schema
PUT
/amazonclouddirectory/2017-01-11/object#x-amz-data-partition
Create an object in a directory
PUT
/amazonclouddirectory/2017-01-11/object/attach#x-amz-data-partition
Attach an object as a child of another object
POST
/amazonclouddirectory/2017-01-11/batchread#x-amz-data-partition
Run a batch read
PUT
/amazonclouddirectory/2017-01-11/batchwrite#x-amz-data-partition
Run a batch write
PUT
/amazonclouddirectory/2017-01-11/index#x-amz-data-partition
Create an index on a facet attribute
PUT
/amazonclouddirectory/2017-01-11/policy/attach#x-amz-data-partition
Attach a policy to an object
PUT
/amazonclouddirectory/2017-01-11/typedlink/attach#x-amz-data-partition
Attach a typed link between two objects
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
AWS access key ID and secret access key for Amazon CloudDirectory are stored encrypted in the Jentic vault. Agents receive scoped, short-lived signing credentials and the raw IAM secrets never enter the agent context. Jentic computes the AWS Signature Version 4 signature server-side for every request.
Intent-based discovery
Agents search Jentic by intent (for example, 'create a Cloud Directory object') and Jentic returns matching Amazon CloudDirectory operations with their input schemas, the correct AWS service endpoint, and the required IAM action, so the agent can invoke the right call without crawling the AWS docs.
Time to first call
Direct Amazon CloudDirectory integration: 1-3 days for AWS SDK setup, IAM role configuration, Sigv4 signing, and error handling. Through Jentic: under 1 hour, search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Amazon CloudDirectory API through Jentic.
What authentication does the Amazon Cloud Directory API use?
All requests are signed with AWS Signature Version 4 using an AWS access key ID and secret access key. Through Jentic, those credentials live encrypted in the vault and Jentic computes the signature server-side, so the agent only ever holds a scoped Jentic credential.
How does Cloud Directory differ from AWS Directory Service or AWS Identity Store?
Directory Service offers managed Microsoft Active Directory and Simple AD for user authentication; Identity Store backs IAM Identity Center for SSO. Cloud Directory is an application-layer directory for arbitrary hierarchical or graph data, including device fleets, org charts, and course catalogs, not an authentication store for end users.
Can I model graph relationships, not just trees?
Yes. Beyond parent-child attachments, Cloud Directory supports typed links: named, attribute-bearing relationships between two objects. Use AttachTypedLink and ListIncomingTypedLinks or ListOutgoingTypedLinks to traverse graph-shaped data.
How do I do many writes in one call through Jentic?
Search Jentic for 'batch write to a Cloud Directory', load the BatchWrite schema, and execute it with an array of operations (CreateObject, AttachObject, UpdateObjectAttributes, etc.). The operation maps to PUT /amazonclouddirectory/2017-01-11/batchwrite and Cloud Directory applies the operations as a single composite request.
What are the rate limits for the Amazon Cloud Directory API?
Cloud Directory enforces directory-level read and write request rates that scale with directory usage; ThrottlingException is returned when exceeded. High-throughput workloads should use BatchRead and BatchWrite to amortise per-request overhead, and apply exponential backoff on retries.
Is Amazon Cloud Directory free to use?
Cloud Directory charges per object stored, per request (read and write), and a small charge for each typed link and index. There is no upfront cost or minimum commitment; you pay only for the directory data and traffic you generate.
GET STARTED