canonical: https://jentic.com/apis/amazonaws.com/finspace-user-environment-management # AWS FinSpace User Environment Management service Jentic publishes the only available OpenAPI specification for FinSpace User Environment Management service, keeping it validated and agent-ready. FinSpace is AWS's data management and analytics service for the financial services industry, and this management API handles environment lifecycle. The API creates, retrieves, updates, and deletes FinSpace environments and manages tags applied to those environments. It is built for capital markets and financial-data platform teams that need to provision FinSpace environments programmatically as part of a wider data infrastructure pipeline. ## For AI agents Create, configure, and tear down FinSpace environments for financial data analytics through a single management API. ## Scope Does not handle dataset, changeset, or dataview operations and does not run analytics queries - use for FinSpace environment lifecycle and tagging only. ## Capabilities - Create FinSpace environments with KMS encryption and federation configuration - Retrieve environment status, ID, and ARN for downstream automation - Update environment names, descriptions, and federation parameters - Delete FinSpace environments when projects wind down - List all FinSpace environments accessible from the calling account - Apply and remove resource tags for cost allocation and ownership tracking - List tags attached to a specific FinSpace environment ARN ## Use cases ### Quant Team Environment Provisioning Capital markets platform teams use the FinSpace management API to provision dedicated FinSpace environments for quant and research desks. The API drives environment creation with encryption keys and identity federation so each desk receives an isolated analytics workspace tied to a specific KMS key. Environment provisioning typically takes ten to thirty minutes and returns an environment ID for downstream tooling. Example prompt: Create a FinSpace environment named quant-research with KMS key alias/finspace-quant and federation mode FEDERATED. ### Environment Tag Governance Platform governance teams use the tag operations on this API to enforce cost allocation and ownership labels across all FinSpace environments. The API supports adding, removing, and listing tags so audit pipelines can assert that every environment carries the required cost-center, owner, and data-classification labels. Untagged environments can be quarantined automatically. Example prompt: Apply tags cost-center=trading and owner=quant-team to FinSpace environment with ARN arn:aws:finspace:...:environment/abcd. ### Environment Decommissioning Platform teams use the management API to decommission FinSpace environments when projects end, returning the associated KMS keys and freeing the environment quota. The API exposes status fields so decommission scripts can verify deletion has fully completed before proceeding to dependent cleanup. Environment deletion is asynchronous and may take several minutes to settle. Example prompt: Delete FinSpace environment with environmentId env-123 and poll the GetEnvironment status until it is removed. ### Agent-Driven FinSpace Environment Operations via Jentic AI agents use the FinSpace management API through Jentic to handle environment lifecycle requests submitted via internal workflows or chat interfaces. Jentic exposes the eight environment and tag operations as discoverable tools so an agent can search by intent and execute the matching call. This shortens lead time for new analytics workspaces from days to minutes. Example prompt: Search Jentic for create finspace environment, load the CreateEnvironment schema, and execute it for environment macro-research with KMS key alias/finspace-default. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | /environment | Create a FinSpace environment | | GET | /environment | List FinSpace environments | | GET | /environment/{environmentId} | Get details of a specific environment | | PUT | /environment/{environmentId} | Update environment configuration | | DELETE | /environment/{environmentId} | Delete a FinSpace environment | | POST | /tags/{resourceArn} | Apply tags to a FinSpace resource | | GET | /tags/{resourceArn} | List tags for a FinSpace resource | ## Key resources - **Environments** — Create, retrieve, update, and delete FinSpace environments - **Tags** — Apply and remove cost-allocation and ownership tags on environments ## Why Jentic - **Setup:** Wiring the FinSpace environment management service by hand means building SigV4 request signing, resolving the regional finspace.{region}.amazonaws.com host, and handling AWS throttling and retries yourself. Through Jentic you install once, import the FinSpace environment service from the API Directory, store the AWS access keys once, and your agent calls it. - **Permission scoping:** FinSpace puts the environment id in the URL path (/environment/{environmentId}), so a rule can pin your agent to one environment: it can read and update that environment and nothing else. You choose the operations it may call, so environment deletion is not included unless you add it. - **Credential handling:** Your AWS access keys for FinSpace are stored once, encrypted, by your own Jentic One instance and injected at execution time when the request is signed. They never enter the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'provision a FinSpace environment' or 'tag an environment', and Jentic returns the matching FinSpace operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **FinSpace Public Data API** — Manages datasets, changesets, and dataviews inside FinSpace environments - **Amazon SageMaker** — General-purpose machine learning platform on AWS - **AWS Lambda** — Runs custom logic in response to FinSpace lifecycle events ## FAQ ### Why is there no official OpenAPI spec for FinSpace User Environment Management service? AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call FinSpace User Environment Management service via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the FinSpace management API use? FinSpace uses AWS Signature Version 4 request signing. Through Jentic, AWS access keys are stored encrypted in the vault and signing happens server-side, so the agent never sees the raw secret access key. ### Can I provision a FinSpace environment with this API? Yes. POST /environment creates a FinSpace environment with name, KMS key, and federation parameters. The response returns an environmentId; use GET /environment/{environmentId} to poll until the status becomes CREATED. ### What are the rate limits for the FinSpace management API? AWS applies per-account, per-region throttling. Environment lifecycle calls are mutating and have lower allowed rates than describes. Use exponential backoff on ThrottlingException responses; AWS does not publish exact TPS numbers in the spec. ### How do I tag a FinSpace environment through Jentic? Search Jentic for tag finspace resource, load the schema for POST /tags/{resourceArn}, and execute it with the environment ARN and a tags map. Jentic returns the updated tag state. ### Does this API include FinSpace data operations like dataset queries? No. This API only manages environments and tags. Dataset, changeset, and dataview operations live in the FinSpace Public Data API (finspace-data), a separate service. ### Can I limit what my agent is allowed to do with the AWS FinSpace API? Yes. Because you run Jentic One yourself, your own rules decide which FinSpace operations and credentials the agent may use. Since the environment id sits in the URL path (/environment/{environmentId}), a rule can pin the agent to a single environment so it only reads and updates that one and touches nothing else. You also choose which operations are exposed, so you can allow create, get, and tag calls while excluding DELETE /environment/{environmentId} so the agent cannot tear down an environment.