Lists the ID of the given organization.

Lists the enforcement setting of the applied policy.

The response's http status code.

The Amazon WorkMail organization for which the domain is retrieved.

The domain from which you want to retrieve details.

Specifies whether the domain is a test domain provided by WorkMail, or a custom domain.

A list of the DNS records that Amazon WorkMail recommends adding in your DNS provider for the best user experience. The records configure your domain with DMARC, SPF, DKIM, and direct incoming email traffic to SES. See admin guide for more details.

Indicates the status of the domain ownership verification.

Indicates the status of a DKIM verification.

Specifies whether the domain is the default domain for your organization.

The response's http status code.

The organization that contains the user, group, or resource to update.

The user, group, or resource to update.

The value of the email to be updated as primary.

The response's http status code.

The identifier associated with the organization for which the resource is described.

The identifier of the resource to be described.

The email of the described resource.

The state of the resource: enabled (registered to Amazon WorkMail), disabled (deregistered or never registered to WorkMail), or deleted.

The identifier of the described resource.

The date and time when a resource was disabled from WorkMail, in UNIX epoch time format.

The name of the described resource.

The type of the described resource.

The date and time when a resource was enabled for WorkMail, in UNIX epoch time format.

The booking options for the described resource.

The response's http status code.

The AWS Directory Service directory ID.

When true, allows organization interoperability between Amazon WorkMail and Microsoft Exchange. Can only be set to true if an AD Connector directory ID is included in the request.

The Amazon Resource Name (ARN) of a customer managed master key from AWS KMS.

The idempotency token associated with the request.

The email domains to associate with the organization.

The organization alias.

The organization ID.

The response's http status code.

The organization under which the member (user or group) exists.

The member (user or group) to which this alias is added.

The alias to add to the member set.

The response's http status code.

The idempotency token associated with the request.

The organization ID.

If true, deletes the AWS Directory Service directory associated with the organization.

The state of the organization.

The organization ID.

The response's http status code.

The identifier of the organization that contains the user for which the password is reset.

The identifier of the user for whom the password is reset.

The new password for the user.

The response's http status code.

The identifier for the organization under which the group exists.

The identifier for the group to be described.

The email of the described group.

The state of the user: enabled (registered to Amazon WorkMail) or disabled (deregistered or never registered to WorkMail).

The date and time when a user was deregistered from WorkMail, in UNIX epoch time format.

The name of the described group.

The identifier of the described group.

The date and time when a user was registered to WorkMail, in UNIX epoch time format.

The response's http status code.

The mailbox export job ID.

The organization ID.

The state of the mailbox export job.

The Amazon Resource Name (ARN) of the symmetric AWS Key Management Service (AWS KMS) key that encrypts the exported mailbox content.

The mailbox export job start timestamp.

The estimated progress of the mailbox export job, in percentage points.

The mailbox export job end timestamp.

The path to the S3 bucket and file that the mailbox export job is exporting to.

The S3 bucket prefix.

The identifier of the user or resource associated with the mailbox.

The mailbox export job description.

Error information for failed mailbox export jobs.

The name of the S3 bucket.

The ARN of the AWS Identity and Access Management (IAM) role that grants write permission to the Amazon Simple Storage Service (Amazon S3) bucket.

The response's http status code.

The resource ARN.

A list of tag key-value pairs.

The response's http status code.

The identifier for the organization under which the user, group, or resource exists.

The identifier for the user, group, or resource to be updated.

The email for the user, group, or resource to be updated.

The response's http status code.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The maximum number of results to return in a single call.

The identifier for the organization under which the entity exists.

The identifier for the entity for which to list the aliases.

The entity's paginated aliases.

The token to use to retrieve the next page of results. The value is "null" when there are no more results to return.

The response's http status code.

The identifier of the organization under which the user, group, or resource exists.

The identifier of the user, group, or resource for which to update mailbox permissions.

The identifier of the user, group, or resource to which to grant the permissions.

The permissions granted to the grantee. SEND_AS allows the grantee to send email as the owner of the mailbox (the grantee is not mentioned on these emails). SEND_ON_BEHALF allows the grantee to send email on behalf of the owner of the mailbox (the grantee is not mentioned as the physical sender of these emails). FULL_ACCESS allows the grantee full access to the mailbox, irrespective of other folder-level permissions set on the mailbox.

The response's http status code.

Device operating system the simulated user will report.

Device model the simulated user will report.

Device type the simulated user will report.

Device user agent the simulated user will report.

The Amazon WorkMail organization to simulate the access effect for.

The effect of the simulated access, ALLOW or DENY, after evaluating mobile device access rules in the Amazon WorkMail organization for the simulated user parameters.

A list of the rules which matched the simulated user input and produced the effect.

The response's http status code.

The identifier of the organization under which the member (user or group) exists.

The identifier of the member (user or group) that owns the mailbox.

The identifier of the member (user or group) for which to delete granted permissions.

The response's http status code.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The maximum number of results to return in a single call.

The identifier for the organization under which the users exist.

The overview of users for an organization.

The token to use to retrieve the next page of results. This value is `null` when there are no more results to return.

The response's http status code.

The ID of the organization that you are applying the DMARC policy to.

Enforces or suspends a policy after it's applied.

The response's http status code.

The identifier for the organization that contains the user whose mailbox details are being requested.

The identifier for the user whose mailbox details are being requested.

The maximum allowed mailbox size, in MB, for the specified user.

The current mailbox size, in MB, for the specified user.

The response's http status code.

The organization under which the group exists.

The group to which the member (user or group) is associated.

The member (user or group) to associate to the group.

The response's http status code.

The identifier associated with the organization from which the resource is deleted.

The identifier of the resource to be deleted.

The response's http status code.

The name of the resource to be updated.

The resource's booking options to be updated.

The identifier associated with the organization for which the resource is updated.

The identifier of the resource to be updated.

The response's http status code.

The identifier for the organization under which the group exists.

The identifier for the group from which members are removed.

The identifier for the member to be removed to the group.

The response's http status code.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The maximum number of results to return in a single call.

The identifier for the organization under which the resources exist.

One page of the organization's resource representation.

The token used to paginate through all the organization's resources. While results are still available, it has an associated value. When the last page is reached, the token is empty.

The response's http status code.

The identifier for the organization under which the Amazon WorkMail entity exists.

The identifier for the member (user or group) to be updated.

The response's http status code.

The token to use to retrieve the next page of results.

The maximum number of results to return in a single call.

The organization ID.

The token to use to retrieve the next page of results.

The mailbox export job details.

The response's http status code.

The idempotency token for the client request.

Device user agents that the rule will match.

Device types that the rule will match.

Device types that the rule will not match. All other device types will match.

Device operating systems that the rule will not match. All other device operating systems will match.

Device models that the rule will match.

Device operating systems that the rule will match.

The rule description.

Device user agents that the rule will not match. All other device user agents will match.

Device models that the rule will not match. All other device models will match.

The Amazon WorkMail organization under which the rule will be created.

The rule name.

The effect of the rule when it matches. Allowed values are ALLOW or DENY.

The identifier for the newly created mobile device access rule.

The response's http status code.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The maximum number of results to return in a single call.

The identifier of the organization under which the user, group, or resource exists.

The identifier of the user, group, or resource for which to list mailbox permissions.

The token to use to retrieve the next page of results. The value is "null" when there are no more results to return.

One page of the user, group, or resource mailbox permissions.

The response's http status code.

The Amazon WorkMail organization to which you want to apply the override.

Identifies the WorkMail user for the override. Accepts the following types of user identities:

• User ID: 12345678-1234-1234-1234-123456789012 or S-1-1-12-1234567890-123456789-123456789-1234
• Email address: user@domain.tld
• User name: user

The mobile device to which the override applies. DeviceId is case insensitive.

The effect of the override, ALLOW or DENY.

The WorkMail user to which the access override applies.

The date the override was first created.

The date the description was last modified.

The device to which the access override applies.

A description of the override.

The response's http status code.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The maximum number of results to return in a single call.

The identifier for the organization under which the group exists.

The identifier for the group to which the members (users or groups) are associated.

The members associated to the group.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The response's http status code.

The identifier for the organization under which the resource exists.

The identifier of the resource from which delegates' set members are removed.

The identifier for the member (user, group) to be removed from the resource's delegates.

The response's http status code.

The identifier for the organization.

The name of the access control rule.

The response's http status code.

The token used to paginate through the delegates associated with a resource.

The number of maximum results in a page.

The identifier for the organization that contains the resource for which delegates are listed.

The identifier for the resource whose delegates are listed.

One page of the resource's delegates.

The token used to paginate through the delegates associated with a resource. While results are still available, it has an associated value. When the last page is reached, the token is empty.

The response's http status code.

The identifier for the organization.

The access control rules.

The response's http status code.

The identifier for the organization under which the user exists.

The identifier for the user to be described.

The email of the user.

The state of a user: enabled (registered to Amazon WorkMail) or disabled (deregistered or never registered to WorkMail).

The identifier for the described user.

The date and time at which the user was disabled for Amazon WorkMail usage, in UNIX epoch time format.

The name for the user.

The display name of the user.

In certain cases, other entities are modeled as users. If interoperability is enabled, resources are imported into Amazon WorkMail as users. Because different WorkMail organizations rely on different directory types, administrators can distinguish between an unregistered user (account is disabled and has a user role) and the directory administrators. The values are USER, RESOURCE, and SYSTEM_USER.

The date and time at which the user was enabled for Amazon WorkMail usage, in UNIX epoch time format.

The response's http status code.

User IDs to include in the rule.

Access protocol actions to include in the rule. Valid values include ActiveSync, AutoDiscover, EWS, IMAP, SMTP, WindowsOutlook, and WebMail.

User IDs to exclude from the rule.

IPv4 CIDR ranges to include in the rule.

IPv4 CIDR ranges to exclude from the rule.

Access protocol actions to exclude from the rule. Valid values include ActiveSync, AutoDiscover, EWS, IMAP, SMTP, WindowsOutlook, and WebMail.

The rule name.

The rule effect.

The rule description.

The identifier of the organization.

The response's http status code.

The mailbox export job description.

The idempotency token for the client request.

The identifier associated with the organization.

The identifier of the user or resource associated with the mailbox.

The ARN of the AWS Identity and Access Management (IAM) role that grants write permission to the S3 bucket.

The Amazon Resource Name (ARN) of the symmetric AWS Key Management Service (AWS KMS) key that encrypts the exported mailbox content.

The name of the S3 bucket.

The S3 bucket prefix.

The job ID.

The response's http status code.

The identifier for the organization under which the user exists.

The identifier for the member (user or group) from which to have the aliases removed.

The aliases to be removed from the user's set of aliases. Duplicate entries in the list are collapsed into single entries (the list is transformed into a set).

The response's http status code.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The maximum number of results to return in a single call.

The token to use to retrieve the next page of results. The value is "null" when there are no more results to return.

The overview of owned organizations presented as a list of organization summaries.

The response's http status code.

The organization under which the resource exists.

The resource for which members (users or groups) are associated.

The member (user or group) to associate to the resource.

The response's http status code.

The identifier for the organization.

The IPv4 address.

The access protocol action. Valid values include ActiveSync, AutoDiscover, EWS, IMAP, SMTP, WindowsOutlook, and WebMail.

The user ID.

The rule effect.

The rules that match the given parameters, resulting in an effect.

The response's http status code.

The organization ID.

The retention policy ID.

The response's http status code.

The identifier of the organization for which the user is created.

The name for the new user. WorkMail directory user names have a maximum length of 64. All others have a maximum length of 20.

The display name for the new user.

The password for the new user.

The identifier for the new user.

The response's http status code.

The retention policy ID.

The retention policy description.

The organization ID.

The retention policy name.

The retention policy folder configurations.

The response's http status code.

The token to use to retrieve the next page of results. The first call does not require a token.

The maximum number of results to return in a single call.

The Amazon WorkMail organization for which to list domains.

The token to use to retrieve the next page of results. The value becomes null when there are no more results to return.

The list of mail domain summaries, specifying domains that exist in the specified Amazon WorkMail organization, along with the information about whether the domain is or isn't the default.

The response's http status code.

The organization that contains the user to be deleted.

The identifier of the user to be deleted.

The response's http status code.

The resource ARN.

The tag key-value pairs.

The response's http status code.

Idempotency token used when retrying requests.

The Amazon WorkMail organization under which you're creating the domain.

The name of the mail domain to create in Amazon WorkMail and SES.

The response's http status code.

The Amazon WorkMail organization for which to list domains.

The domain name that will become the default domain.

The response's http status code.

User agents that the updated rule will match.

Device types that the updated rule will match.

Device types that the updated rule will not match. All other device types will match.

Device operating systems that the updated rule will not match. All other device operating systems will match.

Device models that the updated rule will match.

Device operating systems that the updated rule will match.

The updated rule description.

User agents that the updated rule will not match. All other user agents will match.

Device models that the updated rule will not match. All other device models will match.

The Amazon WorkMail organization under which the rule will be updated.

The identifier of the rule to be updated.

The updated rule name.

The effect of the rule when it matches. Allowed values are ALLOW or DENY.

The response's http status code.

The Amazon WorkMail organization under which the rule will be deleted.

The identifier of the rule to be deleted.

The response's http status code.

The organization under which the group is to be created.

The name of the group.

The identifier of the group.

The response's http status code.

The identifier for the organization that contains the user for whom to update the mailbox quota.

The identifer for the user for whom to update the mailbox quota.

The updated mailbox quota, in MB, for the specified user.

The response's http status code.

The resource ARN.

The tag keys.

The response's http status code.

The Amazon WorkMail organization for which to list the rules.

The list of mobile device access rules that exist under the specified Amazon WorkMail organization.

The response's http status code.

The organization that contains the group.

The identifier of the group to be deleted.

The response's http status code.

The token to use to retrieve the next page of results. The first call does not contain any tokens.

The maximum number of results to return in a single call.

The identifier for the organization under which the groups exist.

The overview of groups for an organization.

The token to use to retrieve the next page of results. The value is "null" when there are no more results to return.

The response's http status code.

The identifier for the organization to be described.

The identifier for the directory associated with an Amazon WorkMail organization.

The state of an organization.

The Amazon Resource Name (ARN) of the organization.

The alias for an organization.

The date at which the organization became usable in the WorkMail context, in UNIX epoch time format.

The type of directory associated with the WorkMail organization.

The default mail domain associated with the organization.

(Optional) The error message indicating if unexpected behavior was encountered with regards to the organization.

The identifier of an organization.

The response's http status code.

The identifier associated with the organization for which the resource is created.

The name of the new resource.

The type of the new resource. The available types are equipment and room.

The identifier of the new resource.

The response's http status code.

The organization ID.

The retention policy name.

The retention policy ID.

The retention policy folder configurations.

The retention policy description.

The response's http status code.

The Amazon WorkMail organization for which the domain will be deregistered.

The domain to deregister in WorkMail and SES.

The response's http status code.

The idempotency token for the client request.

The job ID.

The organization ID.

The response's http status code.

The WorkMail user under which you list the mobile device access overrides. Accepts the following types of user identities:

• User ID: 12345678-1234-1234-1234-123456789012 or S-1-1-12-1234567890-123456789-123456789-1234
• Email address: user@domain.tld
• User name: user

The token to use to retrieve the next page of results. The first call does not require a token.

The mobile device to which the access override applies.

The maximum number of results to return in a single call.

The Amazon WorkMail organization under which to list mobile device access overrides.

The list of mobile device access overrides that exist for the specified Amazon WorkMail organization and user.

The token to use to retrieve the next page of results. The value is “null” when there are no more results to return.

The response's http status code.

The Amazon WorkMail organization for which the access override will be deleted.

The WorkMail user for which you want to delete the override. Accepts the following types of user identities:

• User ID: 12345678-1234-1234-1234-123456789012 or S-1-1-12-1234567890-123456789-123456789-1234
• Email address: user@domain.tld
• User name: user

The mobile device for which you delete the override. DeviceId is case insensitive.

The response's http status code.

A description of the override.

Identifies the Amazon WorkMail organization for which you create the override.

The WorkMail user for which you create the override. Accepts the following types of user identities:

• User ID: 12345678-1234-1234-1234-123456789012 or S-1-1-12-1234567890-123456789-123456789-1234
• Email address: user@domain.tld
• User name: user

The mobile device for which you create the override. DeviceId is case insensitive.

The effect of the override, ALLOW or DENY.

The response's http status code.

The rule effect.

User IDs to include in the rule.

Access protocol actions to include in the rule. Valid values include ActiveSync, AutoDiscover, EWS, IMAP, SMTP, WindowsOutlook, and WebMail.

The date that the rule was created.

The rule name.

User IDs to exclude from the rule.

The date that the rule was modified.

IPv4 CIDR ranges to include in the rule.

IPv4 CIDR ranges to exclude from the rule.

Access protocol actions to exclude from the rule. Valid values include ActiveSync, AutoDiscover, EWS, IMAP, SMTP, WindowsOutlook, and WebMail.

The rule description.

The resource's ability to automatically decline any conflicting requests.

The resource's ability to automatically decline any recurring requests.

The resource's ability to automatically reply to requests. If disabled, delegates must be associated to the resource.

The identifier for the user or group associated as the resource's delegate.

The type of the delegate: user or group.

The DNS hostname.- For example, domain.example.com.

The value returned by the DNS for a query to that hostname and record type.

The RFC 1035 record type. Possible values: CNAME, A, MX.

The hosted zone ID for a domain hosted in Route 53. Required when configuring a domain hosted in Route 53.

The fully qualified domain name.

The number of days for which the folder-configuration action applies.

The folder name.

The action to take on the folder contents at the end of the folder configuration period.

The email of the group.

The state of the group, which can be ENABLED, DISABLED, or DELETED.

The date indicating when the group was disabled from Amazon WorkMail use.

The name of the group.

The identifier of the group.

The date indicating when the group was enabled for Amazon WorkMail use.

Whether the domain is default or not.

The domain name.

The state of the mailbox export job.

The identifier of the mailbox export job.

The mailbox export job start timestamp.

The estimated progress of the mailbox export job, in percentage points.

The mailbox export job end timestamp.

The path to the S3 bucket and file that the mailbox export job exports to.

The identifier of the user or resource associated with the mailbox.

The mailbox export job description.

The name of the S3 bucket.

The state of the member, which can be ENABLED, DISABLED, or DELETED.

The date indicating when the member was disabled from Amazon WorkMail use.

The name of the member.

The identifier of the member.

A member can be a user or group.

The date indicating when the member was enabled for Amazon WorkMail use.

Identifier of the rule that a simulated user matches.

Name of a rule that a simulated user matches.

The effect of the override, ALLOW or DENY.

The WorkMail user to which the access override applies.

The date the override was first created.

The date the override was last modified.

The device to which the override applies.

A description of the override.

The effect of the rule when it matches. Allowed values are ALLOW or DENY.

Device user agents that a rule will match.

Device types that a rule will match.

Device types that a rule will not match. All other device types will match.

Device operating systems that a rule will not match. All other device types will match.

The date and time at which an access rule was created.

Device models that a rule will match.

The ID assigned to a mobile access rule.

The name of a mobile access rule.

The date and time at which an access rule was modified.

Device operating systems that a rule will match.

The description of a mobile access rule.

Device user agents that a rule will not match. All other device user agents will match.

Device models that a rule will not match. All other device models will match.

The state associated with the organization.

The alias associated with the organization.

The default email domain associated with the organization.

The error message associated with the organization. It is only present if unexpected behavior has occurred with regards to the organization. It provides insight or solutions regarding unexpected behavior.

The identifier associated with the organization.

The identifier of the user, group, or resource to which the permissions are granted.

The type of user, group, or resource referred to in GranteeId.

The permissions granted to the grantee. SEND_AS allows the grantee to send email as the owner of the mailbox (the grantee is not mentioned on these emails). SEND_ON_BEHALF allows the grantee to send email on behalf of the owner of the mailbox (the grantee is not mentioned as the physical sender of these emails). FULL_ACCESS allows the grantee full access to the mailbox, irrespective of other folder-level permissions set on the mailbox.

The email of the resource.

The state of the resource, which can be ENABLED, DISABLED, or DELETED.

The date indicating when the resource was disabled from Amazon WorkMail use.

The name of the resource.

The identifier of the resource.

The type of the resource: equipment or room.

The date indicating when the resource was enabled for Amazon WorkMail use.