@alicloud/cloudsso20210515 1.0.1 → 1.1.0

package/src/client.ts

@@ -1782,6 +1782,72 @@ export class GetGroupResponse extends $tea.Model {
   }
 }
 
+export class GetMFAAuthenticationSettingInfoRequest extends $tea.Model {
+  directoryId?: string;
+  static names(): { [key: string]: string } {
+    return {
+      directoryId: 'DirectoryId',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      directoryId: 'string',
+    };
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+
+export class GetMFAAuthenticationSettingInfoResponseBody extends $tea.Model {
+  MFAAuthenticationSettingInfo?: GetMFAAuthenticationSettingInfoResponseBodyMFAAuthenticationSettingInfo;
+  requestId?: string;
+  static names(): { [key: string]: string } {
+    return {
+      MFAAuthenticationSettingInfo: 'MFAAuthenticationSettingInfo',
+      requestId: 'RequestId',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      MFAAuthenticationSettingInfo: GetMFAAuthenticationSettingInfoResponseBodyMFAAuthenticationSettingInfo,
+      requestId: 'string',
+    };
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+
+export class GetMFAAuthenticationSettingInfoResponse extends $tea.Model {
+  headers: { [key: string]: string };
+  statusCode: number;
+  body: GetMFAAuthenticationSettingInfoResponseBody;
+  static names(): { [key: string]: string } {
+    return {
+      headers: 'headers',
+      statusCode: 'statusCode',
+      body: 'body',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      headers: { 'type': 'map', 'keyType': 'string', 'valueType': 'string' },
+      statusCode: 'number',
+      body: GetMFAAuthenticationSettingInfoResponseBody,
+    };
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+
 export class GetMFAAuthenticationSettingsRequest extends $tea.Model {
   directoryId?: string;
   static names(): { [key: string]: string } {
@@ -4261,10 +4327,12 @@ export class UpdateInlinePolicyForAccessConfigurationResponse extends $tea.Model
 export class UpdateMFAAuthenticationSettingsRequest extends $tea.Model {
   directoryId?: string;
   MFAAuthenticationSettings?: string;
+  operationForRiskLogin?: string;
   static names(): { [key: string]: string } {
     return {
       directoryId: 'DirectoryId',
       MFAAuthenticationSettings: 'MFAAuthenticationSettings',
+      operationForRiskLogin: 'OperationForRiskLogin',
     };
   }
 
@@ -4272,6 +4340,7 @@ export class UpdateMFAAuthenticationSettingsRequest extends $tea.Model {
     return {
       directoryId: 'string',
       MFAAuthenticationSettings: 'string',
+      operationForRiskLogin: 'string',
     };
   }
 
@@ -5077,6 +5146,7 @@ export class GetDirectoryStatisticsResponseBodyDirectoryStatistics extends $tea.
   SCIMServerCredentialCount?: number;
   SCIMSyncEnabled?: boolean;
   SSOEnabled?: boolean;
+  systemPolicyPerAccessConfigurationQuota?: number;
   userCount?: number;
   userQuota?: number;
   static names(): { [key: string]: string } {
@@ -5093,6 +5163,7 @@ export class GetDirectoryStatisticsResponseBodyDirectoryStatistics extends $tea.
       SCIMServerCredentialCount: 'SCIMServerCredentialCount',
       SCIMSyncEnabled: 'SCIMSyncEnabled',
       SSOEnabled: 'SSOEnabled',
+      systemPolicyPerAccessConfigurationQuota: 'SystemPolicyPerAccessConfigurationQuota',
       userCount: 'UserCount',
       userQuota: 'UserQuota',
     };
@@ -5112,6 +5183,7 @@ export class GetDirectoryStatisticsResponseBodyDirectoryStatistics extends $tea.
       SCIMServerCredentialCount: 'number',
       SCIMSyncEnabled: 'boolean',
       SSOEnabled: 'boolean',
+      systemPolicyPerAccessConfigurationQuota: 'number',
       userCount: 'number',
       userQuota: 'number',
     };
@@ -5199,6 +5271,28 @@ export class GetGroupResponseBodyGroup extends $tea.Model {
   }
 }
 
+export class GetMFAAuthenticationSettingInfoResponseBodyMFAAuthenticationSettingInfo extends $tea.Model {
+  mfaAuthenticationAdvanceSettings?: string;
+  operationForRiskLogin?: string;
+  static names(): { [key: string]: string } {
+    return {
+      mfaAuthenticationAdvanceSettings: 'MfaAuthenticationAdvanceSettings',
+      operationForRiskLogin: 'OperationForRiskLogin',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      mfaAuthenticationAdvanceSettings: 'string',
+      operationForRiskLogin: 'string',
+    };
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+
 export class GetServiceStatusResponseBodyServiceStatus extends $tea.Model {
   accountId?: string;
   prerequisiteCheckResult?: string;
@@ -6212,6 +6306,16 @@ export default class Client extends OpenApi {
     return EndpointUtil.getEndpointRules(productId, regionId, endpointRule, network, suffix);
   }
 
+  /**
+    * You can add up to two SAML signing certificates.
+    * This topic provides an example on how to add a SAML signing certificate to the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request AddExternalSAMLIdPCertificateRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return AddExternalSAMLIdPCertificateResponse
+   */
   async addExternalSAMLIdPCertificateWithOptions(request: AddExternalSAMLIdPCertificateRequest, runtime: $Util.RuntimeOptions): Promise<AddExternalSAMLIdPCertificateResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6240,11 +6344,29 @@ export default class Client extends OpenApi {
     return $tea.cast<AddExternalSAMLIdPCertificateResponse>(await this.callApi(params, req, runtime), new AddExternalSAMLIdPCertificateResponse({}));
   }
 
+  /**
+    * You can add up to two SAML signing certificates.
+    * This topic provides an example on how to add a SAML signing certificate to the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request AddExternalSAMLIdPCertificateRequest
+    * @return AddExternalSAMLIdPCertificateResponse
+   */
   async addExternalSAMLIdPCertificate(request: AddExternalSAMLIdPCertificateRequest): Promise<AddExternalSAMLIdPCertificateResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.addExternalSAMLIdPCertificateWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to add the system policy `AliyunECSFullAccess` to the access configuration `ac-00jhtfl8thteu6uj****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request AddPermissionPolicyToAccessConfigurationRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return AddPermissionPolicyToAccessConfigurationResponse
+   */
   async addPermissionPolicyToAccessConfigurationWithOptions(request: AddPermissionPolicyToAccessConfigurationRequest, runtime: $Util.RuntimeOptions): Promise<AddPermissionPolicyToAccessConfigurationResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6285,11 +6407,29 @@ export default class Client extends OpenApi {
     return $tea.cast<AddPermissionPolicyToAccessConfigurationResponse>(await this.callApi(params, req, runtime), new AddPermissionPolicyToAccessConfigurationResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to add the system policy `AliyunECSFullAccess` to the access configuration `ac-00jhtfl8thteu6uj****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request AddPermissionPolicyToAccessConfigurationRequest
+    * @return AddPermissionPolicyToAccessConfigurationResponse
+   */
   async addPermissionPolicyToAccessConfiguration(request: AddPermissionPolicyToAccessConfigurationRequest): Promise<AddPermissionPolicyToAccessConfigurationResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.addPermissionPolicyToAccessConfigurationWithOptions(request, runtime);
   }
 
+  /**
+    * If System for Cross-domain Identity Management (SCIM) synchronization is enabled, you cannot add a user to a group that is synchronized by using SCIM.
+    * This topic provides an example of how to add the user `u-00q8wbq42wiltcrk****` to the group `g-00jqzghi2n3o5hkh****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request AddUserToGroupRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return AddUserToGroupResponse
+   */
   async addUserToGroupWithOptions(request: AddUserToGroupRequest, runtime: $Util.RuntimeOptions): Promise<AddUserToGroupResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6322,11 +6462,30 @@ export default class Client extends OpenApi {
     return $tea.cast<AddUserToGroupResponse>(await this.callApi(params, req, runtime), new AddUserToGroupResponse({}));
   }
 
+  /**
+    * If System for Cross-domain Identity Management (SCIM) synchronization is enabled, you cannot add a user to a group that is synchronized by using SCIM.
+    * This topic provides an example of how to add the user `u-00q8wbq42wiltcrk****` to the group `g-00jqzghi2n3o5hkh****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request AddUserToGroupRequest
+    * @return AddUserToGroupResponse
+   */
   async addUserToGroup(request: AddUserToGroupRequest): Promise<AddUserToGroupResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.addUserToGroupWithOptions(request, runtime);
   }
 
+  /**
+    * If single sign-on (SSO) logon is disabled, you can clear the configurations of a SAML IdP. If SSO logon is enabled, you cannot clear the configurations.
+    * This topic provides an example on how to clear the configurations of the SAML IdP within the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ClearExternalSAMLIdentityProviderRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ClearExternalSAMLIdentityProviderResponse
+   */
   async clearExternalSAMLIdentityProviderWithOptions(request: ClearExternalSAMLIdentityProviderRequest, runtime: $Util.RuntimeOptions): Promise<ClearExternalSAMLIdentityProviderResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6351,11 +6510,31 @@ export default class Client extends OpenApi {
     return $tea.cast<ClearExternalSAMLIdentityProviderResponse>(await this.callApi(params, req, runtime), new ClearExternalSAMLIdentityProviderResponse({}));
   }
 
+  /**
+    * If single sign-on (SSO) logon is disabled, you can clear the configurations of a SAML IdP. If SSO logon is enabled, you cannot clear the configurations.
+    * This topic provides an example on how to clear the configurations of the SAML IdP within the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ClearExternalSAMLIdentityProviderRequest
+    * @return ClearExternalSAMLIdentityProviderResponse
+   */
   async clearExternalSAMLIdentityProvider(request: ClearExternalSAMLIdentityProviderRequest): Promise<ClearExternalSAMLIdentityProviderResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.clearExternalSAMLIdentityProviderWithOptions(request, runtime);
   }
 
+  /**
+    * When you call this operation, an asynchronous task is created. You can call the [GetTask](~~340670~~) operation to query the progress of task execution by using the value of the `TaskId` response parameter.
+    * For more information about how to assign permissions on an account in your resource directory, see [Overview of multi-account authorization](~~266726~~).
+    * This topic provides an example on how to assign access permissions on the account `114240524784****` in your resource directory to the CloudSSO user `u-00q8wbq42wiltcrk****` by using the access configuration `ac-00jhtfl8thteu6uj****`. After the call is successful, the CloudSSO user can access resources within the account in the resource directory.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request CreateAccessAssignmentRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return CreateAccessAssignmentResponse
+   */
   async createAccessAssignmentWithOptions(request: CreateAccessAssignmentRequest, runtime: $Util.RuntimeOptions): Promise<CreateAccessAssignmentResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6400,11 +6579,31 @@ export default class Client extends OpenApi {
     return $tea.cast<CreateAccessAssignmentResponse>(await this.callApi(params, req, runtime), new CreateAccessAssignmentResponse({}));
   }
 
+  /**
+    * When you call this operation, an asynchronous task is created. You can call the [GetTask](~~340670~~) operation to query the progress of task execution by using the value of the `TaskId` response parameter.
+    * For more information about how to assign permissions on an account in your resource directory, see [Overview of multi-account authorization](~~266726~~).
+    * This topic provides an example on how to assign access permissions on the account `114240524784****` in your resource directory to the CloudSSO user `u-00q8wbq42wiltcrk****` by using the access configuration `ac-00jhtfl8thteu6uj****`. After the call is successful, the CloudSSO user can access resources within the account in the resource directory.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request CreateAccessAssignmentRequest
+    * @return CreateAccessAssignmentResponse
+   */
   async createAccessAssignment(request: CreateAccessAssignmentRequest): Promise<CreateAccessAssignmentResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.createAccessAssignmentWithOptions(request, runtime);
   }
 
+  /**
+    * For more information about access configurations, see [Overview of access configurations](~~266737~~).
+    * This topic provides an example on how to create an access configuration named `ECS-Admin`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request CreateAccessConfigurationRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return CreateAccessConfigurationResponse
+   */
   async createAccessConfigurationWithOptions(request: CreateAccessConfigurationRequest, runtime: $Util.RuntimeOptions): Promise<CreateAccessConfigurationResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6445,11 +6644,34 @@ export default class Client extends OpenApi {
     return $tea.cast<CreateAccessConfigurationResponse>(await this.callApi(params, req, runtime), new CreateAccessConfigurationResponse({}));
   }
 
+  /**
+    * For more information about access configurations, see [Overview of access configurations](~~266737~~).
+    * This topic provides an example on how to create an access configuration named `ECS-Admin`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request CreateAccessConfigurationRequest
+    * @return CreateAccessConfigurationResponse
+   */
   async createAccessConfiguration(request: CreateAccessConfigurationRequest): Promise<CreateAccessConfigurationResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.createAccessConfigurationWithOptions(request, runtime);
   }
 
+  /**
+    * A directory is a CloudSSO instance. Before you can use CloudSSO, you must create a directory. The directory is used to manage all CloudSSO resources.
+    * To create a directory, you must select a region. Alibaba Cloud stores data in the directory only in the region that you select. However, you can deploy Alibaba Cloud resources including Elastic Compute Service (ECS) instances and ApsaraDB RDS instances in other regions. You can also use your cloud account for logons and access the Alibaba Cloud resources in other regions. You can select a region to create a directory based on your security compliance requirements and the geographic location of specific users. If you do not have strict security compliance requirements, we recommend that you select a region that is the closest to the geographical location of the specific users. This way, access to cloud resources is accelerated. You can create the CloudSSO directory in the China (Shanghai), China (Hong Kong), US (Silicon Valley), or Germany (Frankfurt) region.
+    * This topic provides an example on how to create a directory named `example` in the China (Shanghai) region.
+    * ## Limits
+    * - You can create only one directory for a management account.
+    * - If you want to change the region of a directory, you must delete the directory and then create a directory in a different region.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request CreateDirectoryRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return CreateDirectoryResponse
+   */
   async createDirectoryWithOptions(request: CreateDirectoryRequest, runtime: $Util.RuntimeOptions): Promise<CreateDirectoryResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6474,11 +6696,33 @@ export default class Client extends OpenApi {
     return $tea.cast<CreateDirectoryResponse>(await this.callApi(params, req, runtime), new CreateDirectoryResponse({}));
   }
 
+  /**
+    * A directory is a CloudSSO instance. Before you can use CloudSSO, you must create a directory. The directory is used to manage all CloudSSO resources.
+    * To create a directory, you must select a region. Alibaba Cloud stores data in the directory only in the region that you select. However, you can deploy Alibaba Cloud resources including Elastic Compute Service (ECS) instances and ApsaraDB RDS instances in other regions. You can also use your cloud account for logons and access the Alibaba Cloud resources in other regions. You can select a region to create a directory based on your security compliance requirements and the geographic location of specific users. If you do not have strict security compliance requirements, we recommend that you select a region that is the closest to the geographical location of the specific users. This way, access to cloud resources is accelerated. You can create the CloudSSO directory in the China (Shanghai), China (Hong Kong), US (Silicon Valley), or Germany (Frankfurt) region.
+    * This topic provides an example on how to create a directory named `example` in the China (Shanghai) region.
+    * ## Limits
+    * - You can create only one directory for a management account.
+    * - If you want to change the region of a directory, you must delete the directory and then create a directory in a different region.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request CreateDirectoryRequest
+    * @return CreateDirectoryResponse
+   */
   async createDirectory(request: CreateDirectoryRequest): Promise<CreateDirectoryResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.createDirectoryWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to create a group named `TestGroup`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request CreateGroupRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return CreateGroupResponse
+   */
   async createGroupWithOptions(request: CreateGroupRequest, runtime: $Util.RuntimeOptions): Promise<CreateGroupResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6511,11 +6755,29 @@ export default class Client extends OpenApi {
     return $tea.cast<CreateGroupResponse>(await this.callApi(params, req, runtime), new CreateGroupResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to create a group named `TestGroup`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request CreateGroupRequest
+    * @return CreateGroupResponse
+   */
   async createGroup(request: CreateGroupRequest): Promise<CreateGroupResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.createGroupWithOptions(request, runtime);
   }
 
+  /**
+    * SCIM credentials are required for SCIM synchronization. You can create up to two SCIM credentials.
+    * This topic provides an example on how to create a SCIM credential within the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request CreateSCIMServerCredentialRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return CreateSCIMServerCredentialResponse
+   */
   async createSCIMServerCredentialWithOptions(request: CreateSCIMServerCredentialRequest, runtime: $Util.RuntimeOptions): Promise<CreateSCIMServerCredentialResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6540,11 +6802,29 @@ export default class Client extends OpenApi {
     return $tea.cast<CreateSCIMServerCredentialResponse>(await this.callApi(params, req, runtime), new CreateSCIMServerCredentialResponse({}));
   }
 
+  /**
+    * SCIM credentials are required for SCIM synchronization. You can create up to two SCIM credentials.
+    * This topic provides an example on how to create a SCIM credential within the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request CreateSCIMServerCredentialRequest
+    * @return CreateSCIMServerCredentialResponse
+   */
   async createSCIMServerCredential(request: CreateSCIMServerCredentialRequest): Promise<CreateSCIMServerCredentialResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.createSCIMServerCredentialWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to create a user named `Alice`.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request CreateUserRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return CreateUserResponse
+   */
   async createUserWithOptions(request: CreateUserRequest, runtime: $Util.RuntimeOptions): Promise<CreateUserResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6597,11 +6877,29 @@ export default class Client extends OpenApi {
     return $tea.cast<CreateUserResponse>(await this.callApi(params, req, runtime), new CreateUserResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to create a user named `Alice`.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request CreateUserRequest
+    * @return CreateUserResponse
+   */
   async createUser(request: CreateUserRequest): Promise<CreateUserResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.createUserWithOptions(request, runtime);
   }
 
+  /**
+    * When you call this operation, an asynchronous task is created. You can call the [GetTask](~~340670~~) operation to query the progress of the task based on the value of the `TaskId` response parameter.
+    * This topic provides an example on how to remove the access permissions on the account `114240524784****` in the resource directory from the CloudSSO user `u-00q8wbq42wiltcrk****`. The access permissions are assigned by using the access configuration `ac-00jhtfl8thteu6uj****`.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteAccessAssignmentRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return DeleteAccessAssignmentResponse
+   */
   async deleteAccessAssignmentWithOptions(request: DeleteAccessAssignmentRequest, runtime: $Util.RuntimeOptions): Promise<DeleteAccessAssignmentResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6650,11 +6948,31 @@ export default class Client extends OpenApi {
     return $tea.cast<DeleteAccessAssignmentResponse>(await this.callApi(params, req, runtime), new DeleteAccessAssignmentResponse({}));
   }
 
+  /**
+    * When you call this operation, an asynchronous task is created. You can call the [GetTask](~~340670~~) operation to query the progress of the task based on the value of the `TaskId` response parameter.
+    * This topic provides an example on how to remove the access permissions on the account `114240524784****` in the resource directory from the CloudSSO user `u-00q8wbq42wiltcrk****`. The access permissions are assigned by using the access configuration `ac-00jhtfl8thteu6uj****`.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteAccessAssignmentRequest
+    * @return DeleteAccessAssignmentResponse
+   */
   async deleteAccessAssignment(request: DeleteAccessAssignmentRequest): Promise<DeleteAccessAssignmentResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.deleteAccessAssignmentWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to delete the access configuration whose ID is `ac-001j9mcm3k7335bc****`.
+    * ## Prerequisites
+    * The access configuration that you want to delete is de-provisioned from the accounts in your resource directory. For more information, see [DeprovisionAccessConfiguration](~~338352~~).
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteAccessConfigurationRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return DeleteAccessConfigurationResponse
+   */
   async deleteAccessConfigurationWithOptions(request: DeleteAccessConfigurationRequest, runtime: $Util.RuntimeOptions): Promise<DeleteAccessConfigurationResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6687,11 +7005,38 @@ export default class Client extends OpenApi {
     return $tea.cast<DeleteAccessConfigurationResponse>(await this.callApi(params, req, runtime), new DeleteAccessConfigurationResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to delete the access configuration whose ID is `ac-001j9mcm3k7335bc****`.
+    * ## Prerequisites
+    * The access configuration that you want to delete is de-provisioned from the accounts in your resource directory. For more information, see [DeprovisionAccessConfiguration](~~338352~~).
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteAccessConfigurationRequest
+    * @return DeleteAccessConfigurationResponse
+   */
   async deleteAccessConfiguration(request: DeleteAccessConfigurationRequest): Promise<DeleteAccessConfigurationResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.deleteAccessConfigurationWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to delete a directory whose ID is `d-00fc2p61****`.
+    * ## Prerequisites
+    * No resources are contained in the directory that you want to delete.
+    * *   Access permissions on the accounts in your resource directory are removed from all users and groups. For more information, see [DeleteAccessAssignment](~~338350~~).
+    * *   Users are deleted. For more information, see [DeleteUser](~~341671~~).
+    * *   Groups are deleted. For more information, see [DeleteGroup](~~341821~~).
+    * *   Access configurations are deleted. For more information, see [DeleteAccessConfiguration](~~336907~~).
+    * *   System for Cross-domain Identity Management (SCIM) credentials are deleted. For more information, see [DeleteSCIMServerCredential](~~341842~~).
+    * *   SSO logon configurations are deleted. For more information, see [ClearExternalSAMLIdentityProvider](~~341573~~).
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteDirectoryRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return DeleteDirectoryResponse
+   */
   async deleteDirectoryWithOptions(request: DeleteDirectoryRequest, runtime: $Util.RuntimeOptions): Promise<DeleteDirectoryResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6716,11 +7061,40 @@ export default class Client extends OpenApi {
     return $tea.cast<DeleteDirectoryResponse>(await this.callApi(params, req, runtime), new DeleteDirectoryResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to delete a directory whose ID is `d-00fc2p61****`.
+    * ## Prerequisites
+    * No resources are contained in the directory that you want to delete.
+    * *   Access permissions on the accounts in your resource directory are removed from all users and groups. For more information, see [DeleteAccessAssignment](~~338350~~).
+    * *   Users are deleted. For more information, see [DeleteUser](~~341671~~).
+    * *   Groups are deleted. For more information, see [DeleteGroup](~~341821~~).
+    * *   Access configurations are deleted. For more information, see [DeleteAccessConfiguration](~~336907~~).
+    * *   System for Cross-domain Identity Management (SCIM) credentials are deleted. For more information, see [DeleteSCIMServerCredential](~~341842~~).
+    * *   SSO logon configurations are deleted. For more information, see [ClearExternalSAMLIdentityProvider](~~341573~~).
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteDirectoryRequest
+    * @return DeleteDirectoryResponse
+   */
   async deleteDirectory(request: DeleteDirectoryRequest): Promise<DeleteDirectoryResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.deleteDirectoryWithOptions(request, runtime);
   }
 
+  /**
+    * If System for Cross-domain Identity Management (SCIM) synchronization is enabled, you cannot delete a group that is synchronized by using SCIM.
+    * ## Prerequisites
+    * The group that you want to delete is not associated with the following resources. If the group is associated with the resources, the deletion fails.
+    * *   Users: You must remove users from the group. For more information, see [RemoveUserFromGroup](~~335116~~).
+    * *   Access permissions: You must remove the access permissions on the accounts in your resource directory from the group. For more information, see [DeleteAccessAssignment](~~338350~~).
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteGroupRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return DeleteGroupResponse
+   */
   async deleteGroupWithOptions(request: DeleteGroupRequest, runtime: $Util.RuntimeOptions): Promise<DeleteGroupResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6749,11 +7123,32 @@ export default class Client extends OpenApi {
     return $tea.cast<DeleteGroupResponse>(await this.callApi(params, req, runtime), new DeleteGroupResponse({}));
   }
 
+  /**
+    * If System for Cross-domain Identity Management (SCIM) synchronization is enabled, you cannot delete a group that is synchronized by using SCIM.
+    * ## Prerequisites
+    * The group that you want to delete is not associated with the following resources. If the group is associated with the resources, the deletion fails.
+    * *   Users: You must remove users from the group. For more information, see [RemoveUserFromGroup](~~335116~~).
+    * *   Access permissions: You must remove the access permissions on the accounts in your resource directory from the group. For more information, see [DeleteAccessAssignment](~~338350~~).
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteGroupRequest
+    * @return DeleteGroupResponse
+   */
   async deleteGroup(request: DeleteGroupRequest): Promise<DeleteGroupResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.deleteGroupWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to unbind the MFA device `mfa-00ujhet8pycljj7j****` from the user `u-00q8wbq42wiltcrk****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteMFADeviceForUserRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return DeleteMFADeviceForUserResponse
+   */
   async deleteMFADeviceForUserWithOptions(request: DeleteMFADeviceForUserRequest, runtime: $Util.RuntimeOptions): Promise<DeleteMFADeviceForUserResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6786,11 +7181,29 @@ export default class Client extends OpenApi {
     return $tea.cast<DeleteMFADeviceForUserResponse>(await this.callApi(params, req, runtime), new DeleteMFADeviceForUserResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to unbind the MFA device `mfa-00ujhet8pycljj7j****` from the user `u-00q8wbq42wiltcrk****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteMFADeviceForUserRequest
+    * @return DeleteMFADeviceForUserResponse
+   */
   async deleteMFADeviceForUser(request: DeleteMFADeviceForUserRequest): Promise<DeleteMFADeviceForUserResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.deleteMFADeviceForUserWithOptions(request, runtime);
   }
 
+  /**
+    * After a SCIM credential is deleted, the synchronization task that uses the SCIM credential fails.
+    * This topic provides an example on how to delete the SCIM credential whose ID is `scimcred-004whl0kvfwcypbi****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteSCIMServerCredentialRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return DeleteSCIMServerCredentialResponse
+   */
   async deleteSCIMServerCredentialWithOptions(request: DeleteSCIMServerCredentialRequest, runtime: $Util.RuntimeOptions): Promise<DeleteSCIMServerCredentialResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6819,11 +7232,34 @@ export default class Client extends OpenApi {
     return $tea.cast<DeleteSCIMServerCredentialResponse>(await this.callApi(params, req, runtime), new DeleteSCIMServerCredentialResponse({}));
   }
 
+  /**
+    * After a SCIM credential is deleted, the synchronization task that uses the SCIM credential fails.
+    * This topic provides an example on how to delete the SCIM credential whose ID is `scimcred-004whl0kvfwcypbi****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteSCIMServerCredentialRequest
+    * @return DeleteSCIMServerCredentialResponse
+   */
   async deleteSCIMServerCredential(request: DeleteSCIMServerCredentialRequest): Promise<DeleteSCIMServerCredentialResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.deleteSCIMServerCredentialWithOptions(request, runtime);
   }
 
+  /**
+    * If System for Cross-domain Identity Management (SCIM) synchronization is enabled, you cannot delete a user that is synchronized by using SCIM.
+    * ## Prerequisites
+    * The user that you want to delete is not associated with the following resources. If the user is associated with the resources, the deletion fails.
+    * *   Multi-factor authentication (MFA) devices: You must unbind the MFA devices from the user. For more information, see [DeleteMFADeviceForUser](~~341675~~).
+    * *   Access permissions: You must remove the access permissions on the accounts in your resource directory from the user. For more information, see [DeleteAccessAssignment](~~338350~~).
+    * *   Groups: You must remove the user from groups. For more information, see [RemoveUserFromGroup](~~335116~~).
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteUserRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return DeleteUserResponse
+   */
   async deleteUserWithOptions(request: DeleteUserRequest, runtime: $Util.RuntimeOptions): Promise<DeleteUserResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6852,11 +7288,34 @@ export default class Client extends OpenApi {
     return $tea.cast<DeleteUserResponse>(await this.callApi(params, req, runtime), new DeleteUserResponse({}));
   }
 
+  /**
+    * If System for Cross-domain Identity Management (SCIM) synchronization is enabled, you cannot delete a user that is synchronized by using SCIM.
+    * ## Prerequisites
+    * The user that you want to delete is not associated with the following resources. If the user is associated with the resources, the deletion fails.
+    * *   Multi-factor authentication (MFA) devices: You must unbind the MFA devices from the user. For more information, see [DeleteMFADeviceForUser](~~341675~~).
+    * *   Access permissions: You must remove the access permissions on the accounts in your resource directory from the user. For more information, see [DeleteAccessAssignment](~~338350~~).
+    * *   Groups: You must remove the user from groups. For more information, see [RemoveUserFromGroup](~~335116~~).
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeleteUserRequest
+    * @return DeleteUserResponse
+   */
   async deleteUser(request: DeleteUserRequest): Promise<DeleteUserResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.deleteUserWithOptions(request, runtime);
   }
 
+  /**
+    * When you call this operation, an asynchronous task is automatically created. You can call the [GetTask](~~340670~~) operation to query the progress of the task based on the value of the `TaskId` response parameter.
+    * This topic provides an example on how to de-provision the access configuration `ac-00jhtfl8thteu6uj****` from the account `114240524784****` in your resource directory.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeprovisionAccessConfigurationRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return DeprovisionAccessConfigurationResponse
+   */
   async deprovisionAccessConfigurationWithOptions(request: DeprovisionAccessConfigurationRequest, runtime: $Util.RuntimeOptions): Promise<DeprovisionAccessConfigurationResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6893,11 +7352,29 @@ export default class Client extends OpenApi {
     return $tea.cast<DeprovisionAccessConfigurationResponse>(await this.callApi(params, req, runtime), new DeprovisionAccessConfigurationResponse({}));
   }
 
+  /**
+    * When you call this operation, an asynchronous task is automatically created. You can call the [GetTask](~~340670~~) operation to query the progress of the task based on the value of the `TaskId` response parameter.
+    * This topic provides an example on how to de-provision the access configuration `ac-00jhtfl8thteu6uj****` from the account `114240524784****` in your resource directory.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DeprovisionAccessConfigurationRequest
+    * @return DeprovisionAccessConfigurationResponse
+   */
   async deprovisionAccessConfiguration(request: DeprovisionAccessConfigurationRequest): Promise<DeprovisionAccessConfigurationResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.deprovisionAccessConfigurationWithOptions(request, runtime);
   }
 
+  /**
+    * If your CloudSSO has no directory, you can disable CloudSSO based on your business requirements. After you disable CloudSSO, you can enable it at any time.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request DisableServiceRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return DisableServiceResponse
+   */
   async disableServiceWithOptions(runtime: $Util.RuntimeOptions): Promise<DisableServiceResponse> {
     let req = new $OpenApi.OpenApiRequest({ });
     let params = new $OpenApi.Params({
@@ -6914,11 +7391,28 @@ export default class Client extends OpenApi {
     return $tea.cast<DisableServiceResponse>(await this.callApi(params, req, runtime), new DisableServiceResponse({}));
   }
 
+  /**
+    * If your CloudSSO has no directory, you can disable CloudSSO based on your business requirements. After you disable CloudSSO, you can enable it at any time.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @return DisableServiceResponse
+   */
   async disableService(): Promise<DisableServiceResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.disableServiceWithOptions(runtime);
   }
 
+  /**
+    * You can call this operation only if your account belongs to the management account that is used to enable a resource directory and has permissions to enable CloudSSO. For more information, see [Enable CloudSSO](~~262819~~).
+    * If you call this operation, you agree to the [Alibaba Cloud International Website Product Terms of Service](https://www.alibabacloud.com/help/doc-detail/42416.htm).
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request EnableServiceRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return EnableServiceResponse
+   */
   async enableServiceWithOptions(runtime: $Util.RuntimeOptions): Promise<EnableServiceResponse> {
     let req = new $OpenApi.OpenApiRequest({ });
     let params = new $OpenApi.Params({
@@ -6935,11 +7429,27 @@ export default class Client extends OpenApi {
     return $tea.cast<EnableServiceResponse>(await this.callApi(params, req, runtime), new EnableServiceResponse({}));
   }
 
+  /**
+    * You can call this operation only if your account belongs to the management account that is used to enable a resource directory and has permissions to enable CloudSSO. For more information, see [Enable CloudSSO](~~262819~~).
+    * If you call this operation, you agree to the [Alibaba Cloud International Website Product Terms of Service](https://www.alibabacloud.com/help/doc-detail/42416.htm).
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @return EnableServiceResponse
+   */
   async enableService(): Promise<EnableServiceResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.enableServiceWithOptions(runtime);
   }
 
+  /**
+    * ## Usage notes
+    * This topic provides an example on how to query the information about the access configuration whose ID is `ac-00ccule7tadaijxc****`.
+    *
+    * @param request GetAccessConfigurationRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetAccessConfigurationResponse
+   */
   async getAccessConfigurationWithOptions(request: GetAccessConfigurationRequest, runtime: $Util.RuntimeOptions): Promise<GetAccessConfigurationResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6968,11 +7478,27 @@ export default class Client extends OpenApi {
     return $tea.cast<GetAccessConfigurationResponse>(await this.callApi(params, req, runtime), new GetAccessConfigurationResponse({}));
   }
 
+  /**
+    * ## Usage notes
+    * This topic provides an example on how to query the information about the access configuration whose ID is `ac-00ccule7tadaijxc****`.
+    *
+    * @param request GetAccessConfigurationRequest
+    * @return GetAccessConfigurationResponse
+   */
   async getAccessConfiguration(request: GetAccessConfigurationRequest): Promise<GetAccessConfigurationResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getAccessConfigurationWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query information about the directory whose ID is `d-00fc2p61****`.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetDirectoryRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetDirectoryResponse
+   */
   async getDirectoryWithOptions(request: GetDirectoryRequest, runtime: $Util.RuntimeOptions): Promise<GetDirectoryResponse> {
     Util.validateModel(request);
     let query = { };
@@ -6997,11 +7523,29 @@ export default class Client extends OpenApi {
     return $tea.cast<GetDirectoryResponse>(await this.callApi(params, req, runtime), new GetDirectoryResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query information about the directory whose ID is `d-00fc2p61****`.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetDirectoryRequest
+    * @return GetDirectoryResponse
+   */
   async getDirectory(request: GetDirectoryRequest): Promise<GetDirectoryResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getDirectoryWithOptions(request, runtime);
   }
 
+  /**
+    * During SAML 2.0-based single sign-on (SSO) logon, CloudSSO is an SP, and the identity management system of an enterprise is an identity provider (IdP).
+    * This topic provides an example on how to query the information about the SP within the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetDirectorySAMLServiceProviderInfoRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetDirectorySAMLServiceProviderInfoResponse
+   */
   async getDirectorySAMLServiceProviderInfoWithOptions(request: GetDirectorySAMLServiceProviderInfoRequest, runtime: $Util.RuntimeOptions): Promise<GetDirectorySAMLServiceProviderInfoResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7026,11 +7570,29 @@ export default class Client extends OpenApi {
     return $tea.cast<GetDirectorySAMLServiceProviderInfoResponse>(await this.callApi(params, req, runtime), new GetDirectorySAMLServiceProviderInfoResponse({}));
   }
 
+  /**
+    * During SAML 2.0-based single sign-on (SSO) logon, CloudSSO is an SP, and the identity management system of an enterprise is an identity provider (IdP).
+    * This topic provides an example on how to query the information about the SP within the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetDirectorySAMLServiceProviderInfoRequest
+    * @return GetDirectorySAMLServiceProviderInfoResponse
+   */
   async getDirectorySAMLServiceProviderInfo(request: GetDirectorySAMLServiceProviderInfoRequest): Promise<GetDirectorySAMLServiceProviderInfoResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getDirectorySAMLServiceProviderInfoWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the statistics of a directory whose ID is `d-00fc2p61****`. The statistics include the number of users, quota for users, number of groups, quota for groups, number of access configurations, quota for access configurations, number of access permissions that are assigned, number of System for Cross-domain Identity Management (SCIM) credentials, number of asynchronous tasks, status of single sign-on (SSO) logon, and status of SCIM synchronization.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetDirectoryStatisticsRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetDirectoryStatisticsResponse
+   */
   async getDirectoryStatisticsWithOptions(request: GetDirectoryStatisticsRequest, runtime: $Util.RuntimeOptions): Promise<GetDirectoryStatisticsResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7055,11 +7617,28 @@ export default class Client extends OpenApi {
     return $tea.cast<GetDirectoryStatisticsResponse>(await this.callApi(params, req, runtime), new GetDirectoryStatisticsResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the statistics of a directory whose ID is `d-00fc2p61****`. The statistics include the number of users, quota for users, number of groups, quota for groups, number of access configurations, quota for access configurations, number of access permissions that are assigned, number of System for Cross-domain Identity Management (SCIM) credentials, number of asynchronous tasks, status of single sign-on (SSO) logon, and status of SCIM synchronization.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetDirectoryStatisticsRequest
+    * @return GetDirectoryStatisticsResponse
+   */
   async getDirectoryStatistics(request: GetDirectoryStatisticsRequest): Promise<GetDirectoryStatisticsResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getDirectoryStatisticsWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the configurations of the SAML IdP within the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetExternalSAMLIdentityProviderRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetExternalSAMLIdentityProviderResponse
+   */
   async getExternalSAMLIdentityProviderWithOptions(request: GetExternalSAMLIdentityProviderRequest, runtime: $Util.RuntimeOptions): Promise<GetExternalSAMLIdentityProviderResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7084,11 +7663,28 @@ export default class Client extends OpenApi {
     return $tea.cast<GetExternalSAMLIdentityProviderResponse>(await this.callApi(params, req, runtime), new GetExternalSAMLIdentityProviderResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the configurations of the SAML IdP within the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetExternalSAMLIdentityProviderRequest
+    * @return GetExternalSAMLIdentityProviderResponse
+   */
   async getExternalSAMLIdentityProvider(request: GetExternalSAMLIdentityProviderRequest): Promise<GetExternalSAMLIdentityProviderResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getExternalSAMLIdentityProviderWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the information about the group `g-00jqzghi2n3o5hkh****` in the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetGroupRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetGroupResponse
+   */
   async getGroupWithOptions(request: GetGroupRequest, runtime: $Util.RuntimeOptions): Promise<GetGroupResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7117,11 +7713,71 @@ export default class Client extends OpenApi {
     return $tea.cast<GetGroupResponse>(await this.callApi(params, req, runtime), new GetGroupResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the information about the group `g-00jqzghi2n3o5hkh****` in the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetGroupRequest
+    * @return GetGroupResponse
+   */
   async getGroup(request: GetGroupRequest): Promise<GetGroupResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getGroupWithOptions(request, runtime);
   }
 
+  /**
+    * If you enable username-password logon for CloudSSO users, you can also configure MFA for the users.
+    * This topic provides an example on how to query the MFA setting of all CloudSSO users that belong to the directory named `00q8wbq42wiltcrk****`.
+    *
+    * @param request GetMFAAuthenticationSettingInfoRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetMFAAuthenticationSettingInfoResponse
+   */
+  async getMFAAuthenticationSettingInfoWithOptions(request: GetMFAAuthenticationSettingInfoRequest, runtime: $Util.RuntimeOptions): Promise<GetMFAAuthenticationSettingInfoResponse> {
+    Util.validateModel(request);
+    let query = { };
+    if (!Util.isUnset(request.directoryId)) {
+      query["DirectoryId"] = request.directoryId;
+    }
+
+    let req = new $OpenApi.OpenApiRequest({
+      query: OpenApiUtil.query(query),
+    });
+    let params = new $OpenApi.Params({
+      action: "GetMFAAuthenticationSettingInfo",
+      version: "2021-05-15",
+      protocol: "HTTPS",
+      pathname: "/",
+      method: "POST",
+      authType: "AK",
+      style: "RPC",
+      reqBodyType: "formData",
+      bodyType: "json",
+    });
+    return $tea.cast<GetMFAAuthenticationSettingInfoResponse>(await this.callApi(params, req, runtime), new GetMFAAuthenticationSettingInfoResponse({}));
+  }
+
+  /**
+    * If you enable username-password logon for CloudSSO users, you can also configure MFA for the users.
+    * This topic provides an example on how to query the MFA setting of all CloudSSO users that belong to the directory named `00q8wbq42wiltcrk****`.
+    *
+    * @param request GetMFAAuthenticationSettingInfoRequest
+    * @return GetMFAAuthenticationSettingInfoResponse
+   */
+  async getMFAAuthenticationSettingInfo(request: GetMFAAuthenticationSettingInfoRequest): Promise<GetMFAAuthenticationSettingInfoResponse> {
+    let runtime = new $Util.RuntimeOptions({ });
+    return await this.getMFAAuthenticationSettingInfoWithOptions(request, runtime);
+  }
+
+  /**
+    * > This operation is no longer maintained and updated. You can call the [GetMFAAuthenticationSettingInfo](~~611286~~) operation to query more detailed information.
+    * This topic provides an example on how to query the MFA setting of the users that belong to the directory named `d-00fc2p61****`. The returned result shows that MFA is enabled for all the users.
+    *
+    * @param request GetMFAAuthenticationSettingsRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetMFAAuthenticationSettingsResponse
+   */
   async getMFAAuthenticationSettingsWithOptions(request: GetMFAAuthenticationSettingsRequest, runtime: $Util.RuntimeOptions): Promise<GetMFAAuthenticationSettingsResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7146,11 +7802,27 @@ export default class Client extends OpenApi {
     return $tea.cast<GetMFAAuthenticationSettingsResponse>(await this.callApi(params, req, runtime), new GetMFAAuthenticationSettingsResponse({}));
   }
 
+  /**
+    * > This operation is no longer maintained and updated. You can call the [GetMFAAuthenticationSettingInfo](~~611286~~) operation to query more detailed information.
+    * This topic provides an example on how to query the MFA setting of the users that belong to the directory named `d-00fc2p61****`. The returned result shows that MFA is enabled for all the users.
+    *
+    * @param request GetMFAAuthenticationSettingsRequest
+    * @return GetMFAAuthenticationSettingsResponse
+   */
   async getMFAAuthenticationSettings(request: GetMFAAuthenticationSettingsRequest): Promise<GetMFAAuthenticationSettingsResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getMFAAuthenticationSettingsWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to check whether MFA is enabled for users in the directory whose ID is `00fc2p61****`. The returned result shows that MFA is in the Enabled state.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetMFAAuthenticationStatusRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetMFAAuthenticationStatusResponse
+   */
   async getMFAAuthenticationStatusWithOptions(request: GetMFAAuthenticationStatusRequest, runtime: $Util.RuntimeOptions): Promise<GetMFAAuthenticationStatusResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7175,11 +7847,28 @@ export default class Client extends OpenApi {
     return $tea.cast<GetMFAAuthenticationStatusResponse>(await this.callApi(params, req, runtime), new GetMFAAuthenticationStatusResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to check whether MFA is enabled for users in the directory whose ID is `00fc2p61****`. The returned result shows that MFA is in the Enabled state.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetMFAAuthenticationStatusRequest
+    * @return GetMFAAuthenticationStatusResponse
+   */
   async getMFAAuthenticationStatus(request: GetMFAAuthenticationStatusRequest): Promise<GetMFAAuthenticationStatusResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getMFAAuthenticationStatusWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the status of SCIM synchronization within the directory `d-00fc2p61****`. The returned result shows that SCIM synchronization is in the Enabled state.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetSCIMSynchronizationStatusRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetSCIMSynchronizationStatusResponse
+   */
   async getSCIMSynchronizationStatusWithOptions(request: GetSCIMSynchronizationStatusRequest, runtime: $Util.RuntimeOptions): Promise<GetSCIMSynchronizationStatusResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7204,11 +7893,27 @@ export default class Client extends OpenApi {
     return $tea.cast<GetSCIMSynchronizationStatusResponse>(await this.callApi(params, req, runtime), new GetSCIMSynchronizationStatusResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the status of SCIM synchronization within the directory `d-00fc2p61****`. The returned result shows that SCIM synchronization is in the Enabled state.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetSCIMSynchronizationStatusRequest
+    * @return GetSCIMSynchronizationStatusResponse
+   */
   async getSCIMSynchronizationStatus(request: GetSCIMSynchronizationStatusRequest): Promise<GetSCIMSynchronizationStatusResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getSCIMSynchronizationStatusWithOptions(request, runtime);
   }
 
+  /**
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetServiceStatusRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetServiceStatusResponse
+   */
   async getServiceStatusWithOptions(runtime: $Util.RuntimeOptions): Promise<GetServiceStatusResponse> {
     let req = new $OpenApi.OpenApiRequest({ });
     let params = new $OpenApi.Params({
@@ -7225,11 +7930,26 @@ export default class Client extends OpenApi {
     return $tea.cast<GetServiceStatusResponse>(await this.callApi(params, req, runtime), new GetServiceStatusResponse({}));
   }
 
+  /**
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @return GetServiceStatusResponse
+   */
   async getServiceStatus(): Promise<GetServiceStatusResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getServiceStatusWithOptions(runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the information about the task whose ID is `t-shfqw1u1edszvxw5****`.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetTaskRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetTaskResponse
+   */
   async getTaskWithOptions(request: GetTaskRequest, runtime: $Util.RuntimeOptions): Promise<GetTaskResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7258,11 +7978,29 @@ export default class Client extends OpenApi {
     return $tea.cast<GetTaskResponse>(await this.callApi(params, req, runtime), new GetTaskResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the information about the task whose ID is `t-shfqw1u1edszvxw5****`.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetTaskRequest
+    * @return GetTaskResponse
+   */
   async getTask(request: GetTaskRequest): Promise<GetTaskResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getTaskWithOptions(request, runtime);
   }
 
+  /**
+    * You can call the GetTaskStatus operation to query the status of an asynchronous task. If you want to query more information about an asynchronous task, you can call the [GetTask](~~340670~~) operation.
+    * This topic provides an example on how to query the information about the task whose ID is `t-shfqw1u1edszvxw5****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetTaskStatusRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetTaskStatusResponse
+   */
   async getTaskStatusWithOptions(request: GetTaskStatusRequest, runtime: $Util.RuntimeOptions): Promise<GetTaskStatusResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7291,11 +8029,29 @@ export default class Client extends OpenApi {
     return $tea.cast<GetTaskStatusResponse>(await this.callApi(params, req, runtime), new GetTaskStatusResponse({}));
   }
 
+  /**
+    * You can call the GetTaskStatus operation to query the status of an asynchronous task. If you want to query more information about an asynchronous task, you can call the [GetTask](~~340670~~) operation.
+    * This topic provides an example on how to query the information about the task whose ID is `t-shfqw1u1edszvxw5****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetTaskStatusRequest
+    * @return GetTaskStatusResponse
+   */
   async getTaskStatus(request: GetTaskStatusRequest): Promise<GetTaskStatusResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getTaskStatusWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query information about the user whose ID is `u-00q8wbq42wiltcrk****` in the `d-00fc2p61****` directory.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetUserRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetUserResponse
+   */
   async getUserWithOptions(request: GetUserRequest, runtime: $Util.RuntimeOptions): Promise<GetUserResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7324,11 +8080,26 @@ export default class Client extends OpenApi {
     return $tea.cast<GetUserResponse>(await this.callApi(params, req, runtime), new GetUserResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query information about the user whose ID is `u-00q8wbq42wiltcrk****` in the `d-00fc2p61****` directory.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request GetUserRequest
+    * @return GetUserResponse
+   */
   async getUser(request: GetUserRequest): Promise<GetUserResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getUserWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the MFA setting of the user named `u-00q8wbq42wiltcrk****`. The returned result shows that MFA is enabled for the user.
+    *
+    * @param request GetUserMFAAuthenticationSettingsRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return GetUserMFAAuthenticationSettingsResponse
+   */
   async getUserMFAAuthenticationSettingsWithOptions(request: GetUserMFAAuthenticationSettingsRequest, runtime: $Util.RuntimeOptions): Promise<GetUserMFAAuthenticationSettingsResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7357,11 +8128,26 @@ export default class Client extends OpenApi {
     return $tea.cast<GetUserMFAAuthenticationSettingsResponse>(await this.callApi(params, req, runtime), new GetUserMFAAuthenticationSettingsResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the MFA setting of the user named `u-00q8wbq42wiltcrk****`. The returned result shows that MFA is enabled for the user.
+    *
+    * @param request GetUserMFAAuthenticationSettingsRequest
+    * @return GetUserMFAAuthenticationSettingsResponse
+   */
   async getUserMFAAuthenticationSettings(request: GetUserMFAAuthenticationSettingsRequest): Promise<GetUserMFAAuthenticationSettingsResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.getUserMFAAuthenticationSettingsWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the assigned access permissions on the account `114240524784****` in your resource directory. The returned result shows that access permissions on the account in your resource directory is assigned to one user.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListAccessAssignmentsRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ListAccessAssignmentsResponse
+   */
   async listAccessAssignmentsWithOptions(request: ListAccessAssignmentsRequest, runtime: $Util.RuntimeOptions): Promise<ListAccessAssignmentsResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7414,11 +8200,27 @@ export default class Client extends OpenApi {
     return $tea.cast<ListAccessAssignmentsResponse>(await this.callApi(params, req, runtime), new ListAccessAssignmentsResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the assigned access permissions on the account `114240524784****` in your resource directory. The returned result shows that access permissions on the account in your resource directory is assigned to one user.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListAccessAssignmentsRequest
+    * @return ListAccessAssignmentsResponse
+   */
   async listAccessAssignments(request: ListAccessAssignmentsRequest): Promise<ListAccessAssignmentsResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.listAccessAssignmentsWithOptions(request, runtime);
   }
 
+  /**
+    * ## Usage notes
+    * This topic provides an example on how to query the accounts for which the access permission `ac-00ccule7tadaijxc****` is provisioned. The returned result shows that the access configuration is provisioned for two accounts in your resource directory.
+    *
+    * @param request ListAccessConfigurationProvisioningsRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ListAccessConfigurationProvisioningsResponse
+   */
   async listAccessConfigurationProvisioningsWithOptions(request: ListAccessConfigurationProvisioningsRequest, runtime: $Util.RuntimeOptions): Promise<ListAccessConfigurationProvisioningsResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7467,11 +8269,26 @@ export default class Client extends OpenApi {
     return $tea.cast<ListAccessConfigurationProvisioningsResponse>(await this.callApi(params, req, runtime), new ListAccessConfigurationProvisioningsResponse({}));
   }
 
+  /**
+    * ## Usage notes
+    * This topic provides an example on how to query the accounts for which the access permission `ac-00ccule7tadaijxc****` is provisioned. The returned result shows that the access configuration is provisioned for two accounts in your resource directory.
+    *
+    * @param request ListAccessConfigurationProvisioningsRequest
+    * @return ListAccessConfigurationProvisioningsResponse
+   */
   async listAccessConfigurationProvisionings(request: ListAccessConfigurationProvisioningsRequest): Promise<ListAccessConfigurationProvisioningsResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.listAccessConfigurationProvisioningsWithOptions(request, runtime);
   }
 
+  /**
+    * ## Usage notes
+    * This topic provides an example on how to query the access configurations within the directory `d-00fc2p61****`. The returned result shows that the directory contains the `VPC-Admin` and `ECS-Admin` access configurations.
+    *
+    * @param request ListAccessConfigurationsRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ListAccessConfigurationsResponse
+   */
   async listAccessConfigurationsWithOptions(request: ListAccessConfigurationsRequest, runtime: $Util.RuntimeOptions): Promise<ListAccessConfigurationsResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7512,11 +8329,27 @@ export default class Client extends OpenApi {
     return $tea.cast<ListAccessConfigurationsResponse>(await this.callApi(params, req, runtime), new ListAccessConfigurationsResponse({}));
   }
 
+  /**
+    * ## Usage notes
+    * This topic provides an example on how to query the access configurations within the directory `d-00fc2p61****`. The returned result shows that the directory contains the `VPC-Admin` and `ECS-Admin` access configurations.
+    *
+    * @param request ListAccessConfigurationsRequest
+    * @return ListAccessConfigurationsResponse
+   */
   async listAccessConfigurations(request: ListAccessConfigurationsRequest): Promise<ListAccessConfigurationsResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.listAccessConfigurationsWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the directories within your Alibaba Cloud account. The returned result shows that only one directory with the ID `d-00fc2p61****` is created within your Alibaba Cloud account.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListDirectoriesRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ListDirectoriesResponse
+   */
   async listDirectoriesWithOptions(runtime: $Util.RuntimeOptions): Promise<ListDirectoriesResponse> {
     let req = new $OpenApi.OpenApiRequest({ });
     let params = new $OpenApi.Params({
@@ -7533,11 +8366,27 @@ export default class Client extends OpenApi {
     return $tea.cast<ListDirectoriesResponse>(await this.callApi(params, req, runtime), new ListDirectoriesResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the directories within your Alibaba Cloud account. The returned result shows that only one directory with the ID `d-00fc2p61****` is created within your Alibaba Cloud account.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @return ListDirectoriesResponse
+   */
   async listDirectories(): Promise<ListDirectoriesResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.listDirectoriesWithOptions(runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the SAML signing certificates within the directory `d-00fc2p61****`. The returned result shows that the directory contains one SAML signing certificate.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListExternalSAMLIdPCertificatesRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ListExternalSAMLIdPCertificatesResponse
+   */
   async listExternalSAMLIdPCertificatesWithOptions(request: ListExternalSAMLIdPCertificatesRequest, runtime: $Util.RuntimeOptions): Promise<ListExternalSAMLIdPCertificatesResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7562,11 +8411,28 @@ export default class Client extends OpenApi {
     return $tea.cast<ListExternalSAMLIdPCertificatesResponse>(await this.callApi(params, req, runtime), new ListExternalSAMLIdPCertificatesResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the SAML signing certificates within the directory `d-00fc2p61****`. The returned result shows that the directory contains one SAML signing certificate.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListExternalSAMLIdPCertificatesRequest
+    * @return ListExternalSAMLIdPCertificatesResponse
+   */
   async listExternalSAMLIdPCertificates(request: ListExternalSAMLIdPCertificatesRequest): Promise<ListExternalSAMLIdPCertificatesResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.listExternalSAMLIdPCertificatesWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the users in the group `g-00jqzghi2n3o5hkh****`. The returned result shows that the group contains the user `Alice` and the user `user1`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListGroupMembersRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ListGroupMembersResponse
+   */
   async listGroupMembersWithOptions(request: ListGroupMembersRequest, runtime: $Util.RuntimeOptions): Promise<ListGroupMembersResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7603,11 +8469,28 @@ export default class Client extends OpenApi {
     return $tea.cast<ListGroupMembersResponse>(await this.callApi(params, req, runtime), new ListGroupMembersResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the users in the group `g-00jqzghi2n3o5hkh****`. The returned result shows that the group contains the user `Alice` and the user `user1`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListGroupMembersRequest
+    * @return ListGroupMembersResponse
+   */
   async listGroupMembers(request: ListGroupMembersRequest): Promise<ListGroupMembersResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.listGroupMembersWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the groups in the directory `d-00fc2p61****`. The returned result shows that the directory contains three groups. The groups `group1` and `group2` are synchronized from an external identity provider (IdP). The group `TestGroup` is manually created in CloudSSO.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListGroupsRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ListGroupsResponse
+   */
   async listGroupsWithOptions(request: ListGroupsRequest, runtime: $Util.RuntimeOptions): Promise<ListGroupsResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7648,11 +8531,28 @@ export default class Client extends OpenApi {
     return $tea.cast<ListGroupsResponse>(await this.callApi(params, req, runtime), new ListGroupsResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the groups in the directory `d-00fc2p61****`. The returned result shows that the directory contains three groups. The groups `group1` and `group2` are synchronized from an external identity provider (IdP). The group `TestGroup` is manually created in CloudSSO.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListGroupsRequest
+    * @return ListGroupsResponse
+   */
   async listGroups(request: ListGroupsRequest): Promise<ListGroupsResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.listGroupsWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the groups to which the user `u-00q8wbq42wiltcrk****` is added. The returned result shows that the user is added to both the `TestGroup` and the `group1` groups.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListJoinedGroupsForUserRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ListJoinedGroupsForUserResponse
+   */
   async listJoinedGroupsForUserWithOptions(request: ListJoinedGroupsForUserRequest, runtime: $Util.RuntimeOptions): Promise<ListJoinedGroupsForUserResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7689,11 +8589,28 @@ export default class Client extends OpenApi {
     return $tea.cast<ListJoinedGroupsForUserResponse>(await this.callApi(params, req, runtime), new ListJoinedGroupsForUserResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the groups to which the user `u-00q8wbq42wiltcrk****` is added. The returned result shows that the user is added to both the `TestGroup` and the `group1` groups.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListJoinedGroupsForUserRequest
+    * @return ListJoinedGroupsForUserResponse
+   */
   async listJoinedGroupsForUser(request: ListJoinedGroupsForUserRequest): Promise<ListJoinedGroupsForUserResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.listJoinedGroupsForUserWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the MFA devices that are bound to the user `u-00q8wbq42wiltcrk****`. The returned result shows that the MFA device named `Alice-MFA1` is bound to the user.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListMFADevicesForUserRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ListMFADevicesForUserResponse
+   */
   async listMFADevicesForUserWithOptions(request: ListMFADevicesForUserRequest, runtime: $Util.RuntimeOptions): Promise<ListMFADevicesForUserResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7722,11 +8639,28 @@ export default class Client extends OpenApi {
     return $tea.cast<ListMFADevicesForUserResponse>(await this.callApi(params, req, runtime), new ListMFADevicesForUserResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the MFA devices that are bound to the user `u-00q8wbq42wiltcrk****`. The returned result shows that the MFA device named `Alice-MFA1` is bound to the user.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListMFADevicesForUserRequest
+    * @return ListMFADevicesForUserResponse
+   */
   async listMFADevicesForUser(request: ListMFADevicesForUserRequest): Promise<ListMFADevicesForUserResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.listMFADevicesForUserWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the policies that are created for the access configuration `ac-00jhtfl8thteu6uj****`. The returned result shows that the access configuration contains one system policy and one inline policy.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListPermissionPoliciesInAccessConfigurationRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ListPermissionPoliciesInAccessConfigurationResponse
+   */
   async listPermissionPoliciesInAccessConfigurationWithOptions(request: ListPermissionPoliciesInAccessConfigurationRequest, runtime: $Util.RuntimeOptions): Promise<ListPermissionPoliciesInAccessConfigurationResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7759,11 +8693,28 @@ export default class Client extends OpenApi {
     return $tea.cast<ListPermissionPoliciesInAccessConfigurationResponse>(await this.callApi(params, req, runtime), new ListPermissionPoliciesInAccessConfigurationResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the policies that are created for the access configuration `ac-00jhtfl8thteu6uj****`. The returned result shows that the access configuration contains one system policy and one inline policy.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListPermissionPoliciesInAccessConfigurationRequest
+    * @return ListPermissionPoliciesInAccessConfigurationResponse
+   */
   async listPermissionPoliciesInAccessConfiguration(request: ListPermissionPoliciesInAccessConfigurationRequest): Promise<ListPermissionPoliciesInAccessConfigurationResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.listPermissionPoliciesInAccessConfigurationWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query the SCIM credentials within the `d-00fc2p61****` directory.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListSCIMServerCredentialsRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ListSCIMServerCredentialsResponse
+   */
   async listSCIMServerCredentialsWithOptions(request: ListSCIMServerCredentialsRequest, runtime: $Util.RuntimeOptions): Promise<ListSCIMServerCredentialsResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7788,11 +8739,29 @@ export default class Client extends OpenApi {
     return $tea.cast<ListSCIMServerCredentialsResponse>(await this.callApi(params, req, runtime), new ListSCIMServerCredentialsResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query the SCIM credentials within the `d-00fc2p61****` directory.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListSCIMServerCredentialsRequest
+    * @return ListSCIMServerCredentialsResponse
+   */
   async listSCIMServerCredentials(request: ListSCIMServerCredentialsRequest): Promise<ListSCIMServerCredentialsResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.listSCIMServerCredentialsWithOptions(request, runtime);
   }
 
+  /**
+    * By default, this operation queries the tasks within the previous 24 hours. This operation allows you to query the tasks within a maximum of 7 days. You can specify the start time of the query by using `Filter`.
+    * This topic provides an example on how to query the tasks within the previous 24 hours.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListTasksRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ListTasksResponse
+   */
   async listTasksWithOptions(request: ListTasksRequest, runtime: $Util.RuntimeOptions): Promise<ListTasksResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7857,11 +8826,29 @@ export default class Client extends OpenApi {
     return $tea.cast<ListTasksResponse>(await this.callApi(params, req, runtime), new ListTasksResponse({}));
   }
 
+  /**
+    * By default, this operation queries the tasks within the previous 24 hours. This operation allows you to query the tasks within a maximum of 7 days. You can specify the start time of the query by using `Filter`.
+    * This topic provides an example on how to query the tasks within the previous 24 hours.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListTasksRequest
+    * @return ListTasksResponse
+   */
   async listTasks(request: ListTasksRequest): Promise<ListTasksResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.listTasksWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to query users in the `d-00fc2p61****` directory. The returned result shows that the directory contains two users. The user `AliceLee` is synchronized from an external identity provider (IdP). The user `user1` is manually created within CloudSSO.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListUsersRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ListUsersResponse
+   */
   async listUsersWithOptions(request: ListUsersRequest, runtime: $Util.RuntimeOptions): Promise<ListUsersResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7906,11 +8893,29 @@ export default class Client extends OpenApi {
     return $tea.cast<ListUsersResponse>(await this.callApi(params, req, runtime), new ListUsersResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to query users in the `d-00fc2p61****` directory. The returned result shows that the directory contains two users. The user `AliceLee` is synchronized from an external identity provider (IdP). The user `user1` is manually created within CloudSSO.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ListUsersRequest
+    * @return ListUsersResponse
+   */
   async listUsers(request: ListUsersRequest): Promise<ListUsersResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.listUsersWithOptions(request, runtime);
   }
 
+  /**
+    * When you call this operation, an asynchronous task is automatically created. You can call the [GetTask](~~340670~~) operation to query the progress of the task based on the value of the `TaskId` response parameter.
+    * This topic provides an example on how to provision the access configuration `ac-00jhtfl8thteu6uj****` for the account `114240524784****` in your resource directory.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ProvisionAccessConfigurationRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ProvisionAccessConfigurationResponse
+   */
   async provisionAccessConfigurationWithOptions(request: ProvisionAccessConfigurationRequest, runtime: $Util.RuntimeOptions): Promise<ProvisionAccessConfigurationResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7947,11 +8952,29 @@ export default class Client extends OpenApi {
     return $tea.cast<ProvisionAccessConfigurationResponse>(await this.callApi(params, req, runtime), new ProvisionAccessConfigurationResponse({}));
   }
 
+  /**
+    * When you call this operation, an asynchronous task is automatically created. You can call the [GetTask](~~340670~~) operation to query the progress of the task based on the value of the `TaskId` response parameter.
+    * This topic provides an example on how to provision the access configuration `ac-00jhtfl8thteu6uj****` for the account `114240524784****` in your resource directory.
+    * ## Limits
+    * You can call this operation up to 20 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ProvisionAccessConfigurationRequest
+    * @return ProvisionAccessConfigurationResponse
+   */
   async provisionAccessConfiguration(request: ProvisionAccessConfigurationRequest): Promise<ProvisionAccessConfigurationResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.provisionAccessConfigurationWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to remove the SAML signing certificate whose ID is `idp-c-00dt9gnl7fmjaw9c****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request RemoveExternalSAMLIdPCertificateRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return RemoveExternalSAMLIdPCertificateResponse
+   */
   async removeExternalSAMLIdPCertificateWithOptions(request: RemoveExternalSAMLIdPCertificateRequest, runtime: $Util.RuntimeOptions): Promise<RemoveExternalSAMLIdPCertificateResponse> {
     Util.validateModel(request);
     let query = { };
@@ -7980,11 +9003,29 @@ export default class Client extends OpenApi {
     return $tea.cast<RemoveExternalSAMLIdPCertificateResponse>(await this.callApi(params, req, runtime), new RemoveExternalSAMLIdPCertificateResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to remove the SAML signing certificate whose ID is `idp-c-00dt9gnl7fmjaw9c****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request RemoveExternalSAMLIdPCertificateRequest
+    * @return RemoveExternalSAMLIdPCertificateResponse
+   */
   async removeExternalSAMLIdPCertificate(request: RemoveExternalSAMLIdPCertificateRequest): Promise<RemoveExternalSAMLIdPCertificateResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.removeExternalSAMLIdPCertificateWithOptions(request, runtime);
   }
 
+  /**
+    * After you remove an inline policy from an access configuration, the policy cannot be restored.
+    * This topic provides an example on how to remove the system policy `AliyunECSFullAccess` from the access configuration `ac-00jhtfl8thteu6uj****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request RemovePermissionPolicyFromAccessConfigurationRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return RemovePermissionPolicyFromAccessConfigurationResponse
+   */
   async removePermissionPolicyFromAccessConfigurationWithOptions(request: RemovePermissionPolicyFromAccessConfigurationRequest, runtime: $Util.RuntimeOptions): Promise<RemovePermissionPolicyFromAccessConfigurationResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8021,11 +9062,30 @@ export default class Client extends OpenApi {
     return $tea.cast<RemovePermissionPolicyFromAccessConfigurationResponse>(await this.callApi(params, req, runtime), new RemovePermissionPolicyFromAccessConfigurationResponse({}));
   }
 
+  /**
+    * After you remove an inline policy from an access configuration, the policy cannot be restored.
+    * This topic provides an example on how to remove the system policy `AliyunECSFullAccess` from the access configuration `ac-00jhtfl8thteu6uj****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request RemovePermissionPolicyFromAccessConfigurationRequest
+    * @return RemovePermissionPolicyFromAccessConfigurationResponse
+   */
   async removePermissionPolicyFromAccessConfiguration(request: RemovePermissionPolicyFromAccessConfigurationRequest): Promise<RemovePermissionPolicyFromAccessConfigurationResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.removePermissionPolicyFromAccessConfigurationWithOptions(request, runtime);
   }
 
+  /**
+    * If System for Cross-domain Identity Management (SCIM) synchronization is enabled, you cannot remove a user from a group that is synchronized by using SCIM.  
+    * This topic provides an example on how to remove the user `u-00q8wbq42wiltcrk****` from the group `g-00jqzghi2n3o5hkh****`.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request RemoveUserFromGroupRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return RemoveUserFromGroupResponse
+   */
   async removeUserFromGroupWithOptions(request: RemoveUserFromGroupRequest, runtime: $Util.RuntimeOptions): Promise<RemoveUserFromGroupResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8058,11 +9118,31 @@ export default class Client extends OpenApi {
     return $tea.cast<RemoveUserFromGroupResponse>(await this.callApi(params, req, runtime), new RemoveUserFromGroupResponse({}));
   }
 
+  /**
+    * If System for Cross-domain Identity Management (SCIM) synchronization is enabled, you cannot remove a user from a group that is synchronized by using SCIM.  
+    * This topic provides an example on how to remove the user `u-00q8wbq42wiltcrk****` from the group `g-00jqzghi2n3o5hkh****`.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request RemoveUserFromGroupRequest
+    * @return RemoveUserFromGroupResponse
+   */
   async removeUserFromGroup(request: RemoveUserFromGroupRequest): Promise<RemoveUserFromGroupResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.removeUserFromGroupWithOptions(request, runtime);
   }
 
+  /**
+    * If you forget your password or your password expires or is at risk, you must contact a CloudSSO administrator to reset your password.
+    * >  After you enable SSO logon, your password cannot be reset.
+    * This topic provides an example on how to reset the password of the user `u-00q8wbq42wiltcrk****`. The new password is automatically generated by the system.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ResetUserPasswordRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return ResetUserPasswordResponse
+   */
   async resetUserPasswordWithOptions(request: ResetUserPasswordRequest, runtime: $Util.RuntimeOptions): Promise<ResetUserPasswordResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8103,11 +9183,37 @@ export default class Client extends OpenApi {
     return $tea.cast<ResetUserPasswordResponse>(await this.callApi(params, req, runtime), new ResetUserPasswordResponse({}));
   }
 
+  /**
+    * If you forget your password or your password expires or is at risk, you must contact a CloudSSO administrator to reset your password.
+    * >  After you enable SSO logon, your password cannot be reset.
+    * This topic provides an example on how to reset the password of the user `u-00q8wbq42wiltcrk****`. The new password is automatically generated by the system.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request ResetUserPasswordRequest
+    * @return ResetUserPasswordResponse
+   */
   async resetUserPassword(request: ResetUserPasswordRequest): Promise<ResetUserPasswordResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.resetUserPasswordWithOptions(request, runtime);
   }
 
+  /**
+    * ## Usage notes
+    * During SAML 2.0-based single sign-on (SSO) logon, CloudSSO is an SP, and the identity management system of an enterprise is an IdP.
+    * You can use one of the following methods to configure a SAML IdP. You can obtain the required metadata file or parameter values from your IdP.
+    * *   Use the metadata file. You can specify the `EncodedMetadataDocument` parameter to upload the metadata file.
+    * *   Manually configure the IdP. You can manually specifythe following parameters for your IdP: `EntityId`, `LoginUrl`, `WantRequestSigned`, and `X509Certificate`.
+    * If you have configured a SAML IdP, the existing configurations are replaced after you call this operation.
+    * *   If the IdP is configured by using the metadata file, all existing configurations are replaced with new configurations.
+    * *   If the IdP is manually configured, the original parameter values that are different from the new parameter values are replaced.
+    * >  If SSO logon is enabled, new configurations immediately take effect. Take note of the impacts on the production environment.
+    * This topic provides an example on how to configure an IdP by using the metadata file within the directory `d-00fc2p61****`.
+    *
+    * @param request SetExternalSAMLIdentityProviderRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return SetExternalSAMLIdentityProviderResponse
+   */
   async setExternalSAMLIdentityProviderWithOptions(request: SetExternalSAMLIdentityProviderRequest, runtime: $Util.RuntimeOptions): Promise<SetExternalSAMLIdentityProviderResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8156,11 +9262,36 @@ export default class Client extends OpenApi {
     return $tea.cast<SetExternalSAMLIdentityProviderResponse>(await this.callApi(params, req, runtime), new SetExternalSAMLIdentityProviderResponse({}));
   }
 
+  /**
+    * ## Usage notes
+    * During SAML 2.0-based single sign-on (SSO) logon, CloudSSO is an SP, and the identity management system of an enterprise is an IdP.
+    * You can use one of the following methods to configure a SAML IdP. You can obtain the required metadata file or parameter values from your IdP.
+    * *   Use the metadata file. You can specify the `EncodedMetadataDocument` parameter to upload the metadata file.
+    * *   Manually configure the IdP. You can manually specifythe following parameters for your IdP: `EntityId`, `LoginUrl`, `WantRequestSigned`, and `X509Certificate`.
+    * If you have configured a SAML IdP, the existing configurations are replaced after you call this operation.
+    * *   If the IdP is configured by using the metadata file, all existing configurations are replaced with new configurations.
+    * *   If the IdP is manually configured, the original parameter values that are different from the new parameter values are replaced.
+    * >  If SSO logon is enabled, new configurations immediately take effect. Take note of the impacts on the production environment.
+    * This topic provides an example on how to configure an IdP by using the metadata file within the directory `d-00fc2p61****`.
+    *
+    * @param request SetExternalSAMLIdentityProviderRequest
+    * @return SetExternalSAMLIdentityProviderResponse
+   */
   async setExternalSAMLIdentityProvider(request: SetExternalSAMLIdentityProviderRequest): Promise<SetExternalSAMLIdentityProviderResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.setExternalSAMLIdentityProviderWithOptions(request, runtime);
   }
 
+  /**
+    * If a CloudSSO administrator enables username-password logon for users, CloudSSO automatically enables MFA to improve security. The administrator can call this operation to enable or disable MFA based on the business requirements.
+    * This topic provides an example on how to enable MFA for users.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request SetMFAAuthenticationStatusRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return SetMFAAuthenticationStatusResponse
+   */
   async setMFAAuthenticationStatusWithOptions(request: SetMFAAuthenticationStatusRequest, runtime: $Util.RuntimeOptions): Promise<SetMFAAuthenticationStatusResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8189,11 +9320,32 @@ export default class Client extends OpenApi {
     return $tea.cast<SetMFAAuthenticationStatusResponse>(await this.callApi(params, req, runtime), new SetMFAAuthenticationStatusResponse({}));
   }
 
+  /**
+    * If a CloudSSO administrator enables username-password logon for users, CloudSSO automatically enables MFA to improve security. The administrator can call this operation to enable or disable MFA based on the business requirements.
+    * This topic provides an example on how to enable MFA for users.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request SetMFAAuthenticationStatusRequest
+    * @return SetMFAAuthenticationStatusResponse
+   */
   async setMFAAuthenticationStatus(request: SetMFAAuthenticationStatusRequest): Promise<SetMFAAuthenticationStatusResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.setMFAAuthenticationStatusWithOptions(request, runtime);
   }
 
+  /**
+    * You can synchronize users or groups from an external identity provider (IdP) that supports SCIM 2.0 to CloudSSO only after SCIM synchronization is enabled. If you disable SCIM synchronization, you can no longer synchronize users or groups to CloudSSO. The following list describes the impacts after SCIM synchronization is enabled or disabled:
+    * *   After you enable SCIM synchronization, you cannot modify or delete the users or groups that are synchronized to CloudSSO by using SCIM. In addition, you cannot add users to or remove users from the groups. However, you can change the passwords of the users and enable or disable the logon of the users.
+    * *   After you disable SCIM synchronization, you can modify and delete the users and groups that are synchronized to CloudSSO by using SCIM. You can also add users to or remove users from the groups.
+    * This topic provides an example on how to enable SCIM synchronization within the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request SetSCIMSynchronizationStatusRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return SetSCIMSynchronizationStatusResponse
+   */
   async setSCIMSynchronizationStatusWithOptions(request: SetSCIMSynchronizationStatusRequest, runtime: $Util.RuntimeOptions): Promise<SetSCIMSynchronizationStatusResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8222,11 +9374,32 @@ export default class Client extends OpenApi {
     return $tea.cast<SetSCIMSynchronizationStatusResponse>(await this.callApi(params, req, runtime), new SetSCIMSynchronizationStatusResponse({}));
   }
 
+  /**
+    * You can synchronize users or groups from an external identity provider (IdP) that supports SCIM 2.0 to CloudSSO only after SCIM synchronization is enabled. If you disable SCIM synchronization, you can no longer synchronize users or groups to CloudSSO. The following list describes the impacts after SCIM synchronization is enabled or disabled:
+    * *   After you enable SCIM synchronization, you cannot modify or delete the users or groups that are synchronized to CloudSSO by using SCIM. In addition, you cannot add users to or remove users from the groups. However, you can change the passwords of the users and enable or disable the logon of the users.
+    * *   After you disable SCIM synchronization, you can modify and delete the users and groups that are synchronized to CloudSSO by using SCIM. You can also add users to or remove users from the groups.
+    * This topic provides an example on how to enable SCIM synchronization within the directory `d-00fc2p61****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request SetSCIMSynchronizationStatusRequest
+    * @return SetSCIMSynchronizationStatusResponse
+   */
   async setSCIMSynchronizationStatus(request: SetSCIMSynchronizationStatusRequest): Promise<SetSCIMSynchronizationStatusResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.setSCIMSynchronizationStatusWithOptions(request, runtime);
   }
 
+  /**
+    * You can modify the `Description`, `SessionDuration`, and `RelayState` parameters for an access configuration.
+    * This topic provides an example on how to change the initial web page in the access configuration `ac-00jhtfl8thteu6uj****` to `https://cloudsso.console.aliyun.com`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateAccessConfigurationRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return UpdateAccessConfigurationResponse
+   */
   async updateAccessConfigurationWithOptions(request: UpdateAccessConfigurationRequest, runtime: $Util.RuntimeOptions): Promise<UpdateAccessConfigurationResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8267,11 +9440,30 @@ export default class Client extends OpenApi {
     return $tea.cast<UpdateAccessConfigurationResponse>(await this.callApi(params, req, runtime), new UpdateAccessConfigurationResponse({}));
   }
 
+  /**
+    * You can modify the `Description`, `SessionDuration`, and `RelayState` parameters for an access configuration.
+    * This topic provides an example on how to change the initial web page in the access configuration `ac-00jhtfl8thteu6uj****` to `https://cloudsso.console.aliyun.com`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateAccessConfigurationRequest
+    * @return UpdateAccessConfigurationResponse
+   */
   async updateAccessConfiguration(request: UpdateAccessConfigurationRequest): Promise<UpdateAccessConfigurationResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.updateAccessConfigurationWithOptions(request, runtime);
   }
 
+  /**
+    * After you change the name of a directory, the URL that is used to log on to the Cloud SSO user portal is changed. You must notify the Cloud SSO users of the correct URL. 
+    * This topic provides an example on how to change the name of a directory to `new-example`.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateDirectoryRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return UpdateDirectoryResponse
+   */
   async updateDirectoryWithOptions(request: UpdateDirectoryRequest, runtime: $Util.RuntimeOptions): Promise<UpdateDirectoryResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8300,11 +9492,31 @@ export default class Client extends OpenApi {
     return $tea.cast<UpdateDirectoryResponse>(await this.callApi(params, req, runtime), new UpdateDirectoryResponse({}));
   }
 
+  /**
+    * After you change the name of a directory, the URL that is used to log on to the Cloud SSO user portal is changed. You must notify the Cloud SSO users of the correct URL. 
+    * This topic provides an example on how to change the name of a directory to `new-example`.  
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateDirectoryRequest
+    * @return UpdateDirectoryResponse
+   */
   async updateDirectory(request: UpdateDirectoryRequest): Promise<UpdateDirectoryResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.updateDirectoryWithOptions(request, runtime);
   }
 
+  /**
+    * You can modify `GroupName` and `Description` for a group.
+    * >  If System for Cross-domain Identity Management (SCIM) synchronization is enabled, you cannot modify the information about a group that is synchronized by using SCIM.
+    * This topic provides an example on how to change the name of the group `g-00jqzghi2n3o5hkh****` to `NewTestGroup`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateGroupRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return UpdateGroupResponse
+   */
   async updateGroupWithOptions(request: UpdateGroupRequest, runtime: $Util.RuntimeOptions): Promise<UpdateGroupResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8341,11 +9553,30 @@ export default class Client extends OpenApi {
     return $tea.cast<UpdateGroupResponse>(await this.callApi(params, req, runtime), new UpdateGroupResponse({}));
   }
 
+  /**
+    * You can modify `GroupName` and `Description` for a group.
+    * >  If System for Cross-domain Identity Management (SCIM) synchronization is enabled, you cannot modify the information about a group that is synchronized by using SCIM.
+    * This topic provides an example on how to change the name of the group `g-00jqzghi2n3o5hkh****` to `NewTestGroup`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateGroupRequest
+    * @return UpdateGroupResponse
+   */
   async updateGroup(request: UpdateGroupRequest): Promise<UpdateGroupResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.updateGroupWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to modify an inline policy that is created for the access configuration `ac-00jhtfl8thteu6uj****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateInlinePolicyForAccessConfigurationRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return UpdateInlinePolicyForAccessConfigurationResponse
+   */
   async updateInlinePolicyForAccessConfigurationWithOptions(request: UpdateInlinePolicyForAccessConfigurationRequest, runtime: $Util.RuntimeOptions): Promise<UpdateInlinePolicyForAccessConfigurationResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8382,11 +9613,27 @@ export default class Client extends OpenApi {
     return $tea.cast<UpdateInlinePolicyForAccessConfigurationResponse>(await this.callApi(params, req, runtime), new UpdateInlinePolicyForAccessConfigurationResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to modify an inline policy that is created for the access configuration `ac-00jhtfl8thteu6uj****`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateInlinePolicyForAccessConfigurationRequest
+    * @return UpdateInlinePolicyForAccessConfigurationResponse
+   */
   async updateInlinePolicyForAccessConfiguration(request: UpdateInlinePolicyForAccessConfigurationRequest): Promise<UpdateInlinePolicyForAccessConfigurationResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.updateInlinePolicyForAccessConfigurationWithOptions(request, runtime);
   }
 
+  /**
+    * If you enable username-password logon for CloudSSO users, you can also configure MFA for the users.
+    * This topic provides an example on how to enable MFA for all CloudSSO users that belong to the directory named `d-00fc2p61****`.
+    *
+    * @param request UpdateMFAAuthenticationSettingsRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return UpdateMFAAuthenticationSettingsResponse
+   */
   async updateMFAAuthenticationSettingsWithOptions(request: UpdateMFAAuthenticationSettingsRequest, runtime: $Util.RuntimeOptions): Promise<UpdateMFAAuthenticationSettingsResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8398,6 +9645,10 @@ export default class Client extends OpenApi {
       query["MFAAuthenticationSettings"] = request.MFAAuthenticationSettings;
     }
 
+    if (!Util.isUnset(request.operationForRiskLogin)) {
+      query["OperationForRiskLogin"] = request.operationForRiskLogin;
+    }
+
     let req = new $OpenApi.OpenApiRequest({
       query: OpenApiUtil.query(query),
     });
@@ -8415,11 +9666,27 @@ export default class Client extends OpenApi {
     return $tea.cast<UpdateMFAAuthenticationSettingsResponse>(await this.callApi(params, req, runtime), new UpdateMFAAuthenticationSettingsResponse({}));
   }
 
+  /**
+    * If you enable username-password logon for CloudSSO users, you can also configure MFA for the users.
+    * This topic provides an example on how to enable MFA for all CloudSSO users that belong to the directory named `d-00fc2p61****`.
+    *
+    * @param request UpdateMFAAuthenticationSettingsRequest
+    * @return UpdateMFAAuthenticationSettingsResponse
+   */
   async updateMFAAuthenticationSettings(request: UpdateMFAAuthenticationSettingsRequest): Promise<UpdateMFAAuthenticationSettingsResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.updateMFAAuthenticationSettingsWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to disable the SCIM credential whose ID is `scimcred-004whl0kvfwcypbi****`. After the SCIM credential is disabled, the synchronization task that uses the SCIM credential fails. You can call this operation again to enable the SCIM credential.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateSCIMServerCredentialStatusRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return UpdateSCIMServerCredentialStatusResponse
+   */
   async updateSCIMServerCredentialStatusWithOptions(request: UpdateSCIMServerCredentialStatusRequest, runtime: $Util.RuntimeOptions): Promise<UpdateSCIMServerCredentialStatusResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8452,11 +9719,30 @@ export default class Client extends OpenApi {
     return $tea.cast<UpdateSCIMServerCredentialStatusResponse>(await this.callApi(params, req, runtime), new UpdateSCIMServerCredentialStatusResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to disable the SCIM credential whose ID is `scimcred-004whl0kvfwcypbi****`. After the SCIM credential is disabled, the synchronization task that uses the SCIM credential fails. You can call this operation again to enable the SCIM credential.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateSCIMServerCredentialStatusRequest
+    * @return UpdateSCIMServerCredentialStatusResponse
+   */
   async updateSCIMServerCredentialStatus(request: UpdateSCIMServerCredentialStatusRequest): Promise<UpdateSCIMServerCredentialStatusResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.updateSCIMServerCredentialStatusWithOptions(request, runtime);
   }
 
+  /**
+    * You can modify `FirstName`, `LastName`, `DisplayName`, `Email`, and `Description` for a user. You cannot modify `UserName` for a user.
+    * >  If System for Cross-domain Identity Management (SCIM) synchronization is enabled, you cannot modify the information about a user that is synchronized by using SCIM.
+    * This topic provides an example on how to change the email address of the user whose ID is `u-00q8wbq42wiltcrk****` to `AliceLee@example.com`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateUserRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return UpdateUserResponse
+   */
   async updateUserWithOptions(request: UpdateUserRequest, runtime: $Util.RuntimeOptions): Promise<UpdateUserResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8505,11 +9791,30 @@ export default class Client extends OpenApi {
     return $tea.cast<UpdateUserResponse>(await this.callApi(params, req, runtime), new UpdateUserResponse({}));
   }
 
+  /**
+    * You can modify `FirstName`, `LastName`, `DisplayName`, `Email`, and `Description` for a user. You cannot modify `UserName` for a user.
+    * >  If System for Cross-domain Identity Management (SCIM) synchronization is enabled, you cannot modify the information about a user that is synchronized by using SCIM.
+    * This topic provides an example on how to change the email address of the user whose ID is `u-00q8wbq42wiltcrk****` to `AliceLee@example.com`.
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateUserRequest
+    * @return UpdateUserResponse
+   */
   async updateUser(request: UpdateUserRequest): Promise<UpdateUserResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.updateUserWithOptions(request, runtime);
   }
 
+  /**
+    * If you call the [UpdateMFAAuthenticationSettings](~~450134~~) operation to set the MFAAuthenticationSettings parameter to `Byuser`, user-specific settings are applied. Then, you must call the UpdateUserMFAAuthenticationSettings operation to configure MFA for each user.
+    * By default, the MFAAuthenticationSettings parameter is set to `Enabled` for a new user.
+    * This topic provides an example on how to enable MFA for the user named `u-00q8wbq42wiltcrk****`.
+    *
+    * @param request UpdateUserMFAAuthenticationSettingsRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return UpdateUserMFAAuthenticationSettingsResponse
+   */
   async updateUserMFAAuthenticationSettingsWithOptions(request: UpdateUserMFAAuthenticationSettingsRequest, runtime: $Util.RuntimeOptions): Promise<UpdateUserMFAAuthenticationSettingsResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8542,11 +9847,28 @@ export default class Client extends OpenApi {
     return $tea.cast<UpdateUserMFAAuthenticationSettingsResponse>(await this.callApi(params, req, runtime), new UpdateUserMFAAuthenticationSettingsResponse({}));
   }
 
+  /**
+    * If you call the [UpdateMFAAuthenticationSettings](~~450134~~) operation to set the MFAAuthenticationSettings parameter to `Byuser`, user-specific settings are applied. Then, you must call the UpdateUserMFAAuthenticationSettings operation to configure MFA for each user.
+    * By default, the MFAAuthenticationSettings parameter is set to `Enabled` for a new user.
+    * This topic provides an example on how to enable MFA for the user named `u-00q8wbq42wiltcrk****`.
+    *
+    * @param request UpdateUserMFAAuthenticationSettingsRequest
+    * @return UpdateUserMFAAuthenticationSettingsResponse
+   */
   async updateUserMFAAuthenticationSettings(request: UpdateUserMFAAuthenticationSettingsRequest): Promise<UpdateUserMFAAuthenticationSettingsResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.updateUserMFAAuthenticationSettingsWithOptions(request, runtime);
   }
 
+  /**
+    * This topic provides an example on how to change the status of the user whose ID is `u-00q8wbq42wiltcrk****` to Disabled. Users in the Disabled state cannot log on to the CloudSSO user portal. 
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateUserStatusRequest
+    * @param runtime runtime options for this request RuntimeOptions
+    * @return UpdateUserStatusResponse
+   */
   async updateUserStatusWithOptions(request: UpdateUserStatusRequest, runtime: $Util.RuntimeOptions): Promise<UpdateUserStatusResponse> {
     Util.validateModel(request);
     let query = { };
@@ -8579,6 +9901,14 @@ export default class Client extends OpenApi {
     return $tea.cast<UpdateUserStatusResponse>(await this.callApi(params, req, runtime), new UpdateUserStatusResponse({}));
   }
 
+  /**
+    * This topic provides an example on how to change the status of the user whose ID is `u-00q8wbq42wiltcrk****` to Disabled. Users in the Disabled state cannot log on to the CloudSSO user portal. 
+    * ## Limits
+    * You can call this operation up to 100 times per second per account. This operation is globally limited to 100 times per second across all accounts. If the number of the calls per second exceeds a limit, throttling is triggered. As a result, your business may be affected. We recommend that you take note of the limits when you call this operation.
+    *
+    * @param request UpdateUserStatusRequest
+    * @return UpdateUserStatusResponse
+   */
   async updateUserStatus(request: UpdateUserStatusRequest): Promise<UpdateUserStatusResponse> {
     let runtime = new $Util.RuntimeOptions({ });
     return await this.updateUserStatusWithOptions(request, runtime);