--- title: "List All Cloud Accounts" method: GET path: "/api/v2/CloudAccounts" tags: ["CloudAccounts"] --- # List All Cloud Accounts `GET /api/v2/CloudAccounts` Get a list of cloud accounts for the current user by invoking the following endpoint: > `GET https://YourAccount.lacework.net/api/v2/CloudAccounts` ## Headers - `Authorization` string, required - `Content-Type` string, required - `Org-Access` boolean - `Account-Name` string ## Response `200` No Error (List of Cloud Accounts) - object - `data` CloudAccountsResponseSchema[] - union - CloudAccountsAwsCfgResponseSchema - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name. - `type` 'AwsCfg', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type. - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration. - `cloudId` string — The cloud account identifier. - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier. - `data` object, required - `awsAccountId` string — Your AWS account identifier or alias. This is the Account ID specified for the Cross-Account IAM role created as a preparatory task in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `crossAccountCredentials` object, required — Details of the cross-account role that FortiCNAPP uses to access your AWS resource. - `externalId` string, required — The AWS external ID that is associated with the cross-account role that FortiCNAPP uses to access your AWS resource. This is the External ID specified for the Cross-Account IAM role in your preparatory integration of AWS described in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `roleArn` string, required — The ARN of the cross-account role that FortiCNAPP uses to access your AWS resources. This is the ARN specified for the Cross-Account IAM role in your preparatory integration of AWS described in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`. - `props` object — The integration's properties. - `createdOrUpdatedBy` string — The user who created or who last updated the integration. - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated. - `intgGuid` string — The integration’s globally unique identifier. - `state` object — The integration’s real-time state, such as Pending, Success, or Error. - CloudAccountsAwsCtSqsResponseSchema - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name. - `type` 'AwsCtSqs', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type. - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration. - `cloudId` string — The cloud account identifier. - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier. - `data` object, required - `awsAccountId` string — Your AWS account identifier or alias. This is the Account ID specified for the Cross-Account IAM role created as a preparatory task in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `crossAccountCredentials` object, required — Details of the cross-account role that FortiCNAPP uses to access your AWS resource. - `externalId` string, required — The AWS external ID that is associated with the cross-account role that FortiCNAPP uses to access your AWS resource. This is the External ID specified for the Cross-Account IAM role created as a preparatory task in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `roleArn` string, required — The ARN of the cross-account role that FortiCNAPP uses to access your AWS resources. This is the ARN specified for the Cross-Account IAM role created as a preparatory task in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `queueUrl` string, required — The Amazon Simple Queue Service (SQS) URL value. This is the SQS Queue URL specified for the Cross-Account IAM role created as a preparatory task in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `accountMappingFile` string, data-url — The mapping file to use in the integration. The account mapping file is a JSON file that maps AWS accounts to FortiCNAPP accounts within a FortiCNAPP organization. See [Account Mapping File](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=AWS_ACCOUNT_MAPPING). - `accountMapping` object — If your organization has enabled the [FortiCNAPP Organization](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=orgOverview) feature, when sending a request, you can specify a comma-separated list of AWS organization names that match FortiCNAPP sub-account names. Based on this AWS organization-to-FortiCNAPP sub-account name mapping, FortiCNAPP adds your AWS accounts to the appropriate FortiCNAPP sub-accounts. AWS organization names and FortiCNAPP sub-account names must match. When included in a response, returns a comma-separated list of AWS organization names that match FortiCNAPP sub-account names. - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`. - `props` object — The integration's properties. - `createdOrUpdatedBy` string — The user who created or who last updated the integration. - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated. - `intgGuid` string — The integration’s globally unique identifier. - `state` object — The integration’s real-time state, such as Pending, Success, or Error. - CloudAccountsAwsEksAuditResponseSchema - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name. - `type` 'AwsEksAudit', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type. - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration. - `cloudId` string — The cloud account identifier. - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier. - `data` object, required - `awsAccountId` string — Your AWS account identifier or alias. This is the Account ID specified for the Cross-Account IAM role created as a preparatory task in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `crossAccountCredentials` object, required — Details of the cross-account role that FortiCNAPP uses to access your AWS resource. - `externalId` string, required — The AWS external ID that is associated with the cross-account role that FortiCNAPP uses to access your AWS resource. This is the External ID specified for the Cross-Account IAM role in your preparatory integration of AWS described in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `roleArn` string, required — The ARN of the cross-account role that FortiCNAPP uses to access your AWS resources. This is the ARN specified for the Cross-Account IAM role in your preparatory integration of AWS described in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `snsArn` string, required — The ARN of the SNS topic. An SNS topic is a communication channel for SQS queue messaging from your AWS environment to FortiCNAPP. See [SNS Topic](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites#sns-topic). - `s3BucketArn` string - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`. - `props` object — The integration's properties. - `createdOrUpdatedBy` string — The user who created or who last updated the integration. - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated. - `intgGuid` string — The integration’s globally unique identifier. - `state` object — The integration’s real-time state, such as Pending, Success, or Error. - CloudAccountsAwsUsGovCfgResponseSchema - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name. - `type` 'AwsUsGovCfg', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type. - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration. - `cloudId` string — The cloud account identifier. - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier. - `data` object, required - `accessKeyCredentials` object, required — The credentials of your AWS GovCloud account. AWS GovCloud (US-East and US-West) are isolated regions within AWS for customers to host sensitive data for supporting their regulated workflows. - `accountId` string, required — Your AWS account identifier or alias. - `accessKeyId` string, required — The AccessKeyId value from your AWS console. - `secretAccessKey` string, password, required — The SecretAccessKey value from your AWS console. - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`. - `props` object — The integration's properties. - `createdOrUpdatedBy` string — The user who created or who last updated the integration. - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated. - `intgGuid` string — The integration’s globally unique identifier. - `state` object — The integration’s real-time state, such as Pending, Success, or Error. - CloudAccountsAwsUsGovCtSqsResponseSchema - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name. - `type` 'AwsUsGovCtSqs', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type. - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration. - `cloudId` string — The cloud account identifier. - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier. - `data` object, required - `accessKeyCredentials` object, required — The credentials of your AWS GovCloud account. AWS GovCloud (US-East and US-West) are isolated regions within AWS for customers to host sensitive data for supporting their regulated workflows. - `accountId` string, required — Your AWS account identifier or alias. - `accessKeyId` string, required — The AccessKeyId value from your AWS console. - `secretAccessKey` string, password, required — The SecretAccessKey value from your AWS console. - `queueUrl` string, required — Your AWS account identifier or alias. This is the Account ID specified for the Cross-Account IAM role created as a preparatory task in [AWS Integration Prerequisites](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSIntegrationPrerequisites). - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`. - `props` object — The integration's properties. - `createdOrUpdatedBy` string — The user who created or who last updated the integration. - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated. - `intgGuid` string — The integration’s globally unique identifier. - `state` object — The integration’s real-time state, such as Pending, Success, or Error. - CloudAccountsAzureAlSeqResponseSchema - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name. - `type` 'AzureAlSeq', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type. - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration. - `cloudId` string — The cloud account identifier. - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier. - `data` object, required - `credentials` object, required — Your Azure credentials. - `clientId` string, required — The ApplicationId value from your Azure portal. - `clientSecret` string, required — Your Azure client secret. - `tenantId` string, required — The DirectoryId value from your Azure portal. - `queueUrl` string, required — The queue URL to access. - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`. - `props` object — The integration's properties. - `createdOrUpdatedBy` string — The user who created or who last updated the integration. - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated. - `intgGuid` string — The integration’s globally unique identifier. - `state` object — The integration’s real-time state, such as Pending, Success, or Error. - CloudAccountsAzureCfgResponseSchema - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name. - `type` 'AzureCfg', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type. - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration. - `cloudId` string — The cloud account identifier. - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier. - `data` object, required - `credentials` object, required — Your Azure credentials. - `clientId` string, required — The ApplicationId value from your Azure portal. - `clientSecret` string, required — Your Azure client secret. - `tenantId` string, required — The DirectoryId value from your Azure portal. - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`. - `props` object — The integration's properties. - `createdOrUpdatedBy` string — The user who created or who last updated the integration. - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated. - `intgGuid` string — The integration’s globally unique identifier. - `state` object — The integration’s real-time state, such as Pending, Success, or Error. - CloudAccountsGcpAtSesResponseSchema - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name. - `type` 'GcpAtSes', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type. - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration. - `cloudId` string — The cloud account identifier. - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier. - `data` object, required - `credentials` object, required — Your GCP credentials. - `clientId` string, required — Your GCP client (application) identifier or alias. - `privateKeyId` string, required — Your client private key identifier. - `clientEmail` string, required — Your client email address. - `privateKey` string — The secret key value for your client ID. - `idType` 'ORGANIZATION' | 'PROJECT', required — The GCP integration level as either **Organization** or **Project**. - `id` string, required — The organization or project identifier to associate with your integration. - `subscriptionName` string, required — The pub/sub queue subscription name. - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`. - `props` object — The integration's properties. - `createdOrUpdatedBy` string — The user who created or who last updated the integration. - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated. - `intgGuid` string — The integration’s globally unique identifier. - `state` object — The integration’s real-time state, such as Pending, Success, or Error. - CloudAccountsGcpCfgResponseSchema - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name. - `type` 'GcpCfg', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type. - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration. - `cloudId` string — The cloud account identifier. - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier. - `data` object, required - `credentials` object, required — Your GCP credentials. - `clientId` string, required — Your GCP client (application) identifier or alias. - `privateKeyId` string, required — Your client private key identifier. - `clientEmail` string, required — Your client email address. - `privateKey` string, required — The secret key value for your client ID. - `idType` 'ORGANIZATION' | 'PROJECT', required — The GCP integration level as either `Organization` or `Project` - `id` string, required — The organization or project identifier to associate with your integration. - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`. - `props` object — The integration's properties. - `createdOrUpdatedBy` string — The user who created or who last updated the integration. - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated. - `intgGuid` string — The integration’s globally unique identifier. - `state` object — The integration’s real-time state, such as Pending, Success, or Error. - CloudAccountsGcpGkeAuditResponseSchema - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name. - `type` 'GcpGkeAudit', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type. - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration. - `cloudId` string — The cloud account identifier. - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier. - `data` object, required - `credentials` object, required - `clientId` string, required - `privateKeyId` string, required - `clientEmail` string, required - `privateKey` string - `integrationType` 'ORGANIZATION' | 'PROJECT', required - `projectId` string, required - `organizationId` string - `subscriptionName` string, required - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`. - `props` object — The integration's properties. - `createdOrUpdatedBy` string — The user who created or who last updated the integration. - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated. - `intgGuid` string — The integration’s globally unique identifier. - `state` object — The integration’s real-time state, such as Pending, Success, or Error. ## Other responses - `204` — No Data - `4XX` — Client Error - `5XX` — Internal Server Error --- [API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)