@aws-sdk/client-signin 3.1082.0 → 3.1084.0

package/dist-types/commands/IntrospectOAuth2TokenWithIAMCommand.d.ts

@@ -0,0 +1,134 @@
+import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
+import type { IntrospectOAuth2TokenWithIAMRequest, IntrospectOAuth2TokenWithIAMResponse } from "../models/models_0";
+/**
+ * @public
+ */
+export type { __MetadataBearer };
+/**
+ * @public
+ *
+ * The input for {@link IntrospectOAuth2TokenWithIAMCommand}.
+ */
+export interface IntrospectOAuth2TokenWithIAMCommandInput extends IntrospectOAuth2TokenWithIAMRequest {
+}
+/**
+ * @public
+ *
+ * The output of {@link IntrospectOAuth2TokenWithIAMCommand}.
+ */
+export interface IntrospectOAuth2TokenWithIAMCommandOutput extends IntrospectOAuth2TokenWithIAMResponse, __MetadataBearer {
+}
+declare const IntrospectOAuth2TokenWithIAMCommand_base: {
+    new (input: IntrospectOAuth2TokenWithIAMCommandInput): import("@smithy/core/client").CommandImpl<IntrospectOAuth2TokenWithIAMCommandInput, IntrospectOAuth2TokenWithIAMCommandOutput, import("..").SigninClientResolvedConfig, import("..").ServiceInputTypes, import("..").ServiceOutputTypes>;
+    new (input: IntrospectOAuth2TokenWithIAMCommandInput): import("@smithy/core/client").CommandImpl<IntrospectOAuth2TokenWithIAMCommandInput, IntrospectOAuth2TokenWithIAMCommandOutput, import("..").SigninClientResolvedConfig, import("..").ServiceInputTypes, import("..").ServiceOutputTypes>;
+    getEndpointParameterInstructions(): import("@smithy/types").EndpointParameterInstructions;
+};
+/**
+ * Grants permission to inspect the metadata and state of an OAuth 2.0
+ * access token or refresh token
+ *
+ * Implements RFC 7662 OAuth 2.0 Token Introspection over a SigV4-authenticated
+ * endpoint. Inspects the metadata of an access_token or refresh_token issued
+ * by AWS Sign-In and returns the claims associated with it.
+ *
+ * Inactive token semantics (RFC 7662 §2.2): when the supplied token is
+ * unknown, expired, revoked, malformed, or owned by a different account,
+ * the response body is exactly \{ "active": false \} with all other claims
+ * omitted.
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { SigninClient, IntrospectOAuth2TokenWithIAMCommand } from "@aws-sdk/client-signin"; // ES Modules import
+ * // const { SigninClient, IntrospectOAuth2TokenWithIAMCommand } = require("@aws-sdk/client-signin"); // CommonJS import
+ * // import type { SigninClientConfig } from "@aws-sdk/client-signin";
+ * const config = {}; // type is SigninClientConfig
+ * const client = new SigninClient(config);
+ * const input = { // IntrospectOAuth2TokenWithIAMRequest
+ *   token: "STRING_VALUE", // required
+ *   tokenTypeHint: "STRING_VALUE",
+ * };
+ * const command = new IntrospectOAuth2TokenWithIAMCommand(input);
+ * const response = await client.send(command);
+ * // { // IntrospectOAuth2TokenWithIAMResponse
+ * //   active: true || false, // required
+ * //   clientId: "STRING_VALUE",
+ * //   userId: "STRING_VALUE",
+ * //   tokenType: "STRING_VALUE",
+ * //   exp: Number("long"),
+ * //   iat: Number("long"),
+ * //   nbf: Number("long"),
+ * //   sub: "STRING_VALUE",
+ * //   aud: "STRING_VALUE",
+ * //   iss: "STRING_VALUE",
+ * //   jti: "STRING_VALUE",
+ * //   accountId: "STRING_VALUE",
+ * //   signinSession: "STRING_VALUE",
+ * //   resource: "STRING_VALUE",
+ * // };
+ *
+ * ```
+ *
+ * @param IntrospectOAuth2TokenWithIAMCommandInput - {@link IntrospectOAuth2TokenWithIAMCommandInput}
+ * @returns {@link IntrospectOAuth2TokenWithIAMCommandOutput}
+ * @see {@link IntrospectOAuth2TokenWithIAMCommandInput} for command's `input` shape.
+ * @see {@link IntrospectOAuth2TokenWithIAMCommandOutput} for command's `response` shape.
+ * @see {@link SigninClientResolvedConfig | config} for SigninClient's `config` shape.
+ *
+ * @throws {@link AccessDeniedException} (client fault)
+ *  Error thrown for access denied scenarios with flexible HTTP status mapping
+ *
+ * Runtime HTTP Status Code Mapping:
+ * - HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
+ * - HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS
+ *
+ * The specific HTTP status code is determined at runtime based on the error enum value.
+ * Consumers should use the error field to determine the specific access denial reason.
+ *
+ * @throws {@link InternalServerException} (server fault)
+ *  Error thrown when an internal server error occurs
+ *
+ * HTTP Status Code: 500 Internal Server Error
+ *
+ * Used for unexpected server-side errors that prevent request processing.
+ *
+ * @throws {@link TooManyRequestsError} (client fault)
+ *  Error thrown when rate limit is exceeded
+ *
+ * HTTP Status Code: 429 Too Many Requests
+ *
+ * Possible OAuth2ErrorCode values:
+ * - INVALID_REQUEST: Rate limiting, too many requests, abuse prevention
+ *
+ * Possible causes:
+ * - Too many token requests from the same client
+ * - Rate limiting based on client_id or IP address
+ * - Abuse prevention mechanisms triggered
+ * - Service protection against excessive token generation
+ *
+ * @throws {@link ValidationException} (client fault)
+ *  Error thrown when request validation fails
+ *
+ * HTTP Status Code: 400 Bad Request
+ *
+ * Used for request validation errors such as malformed parameters,
+ * missing required fields, or invalid parameter values.
+ *
+ * @throws {@link SigninServiceException}
+ * <p>Base exception class for all service exceptions from Signin service.</p>
+ *
+ *
+ * @public
+ */
+export declare class IntrospectOAuth2TokenWithIAMCommand extends IntrospectOAuth2TokenWithIAMCommand_base {
+    /** @internal type navigation helper, not in runtime. */
+    protected static __types: {
+        api: {
+            input: IntrospectOAuth2TokenWithIAMRequest;
+            output: IntrospectOAuth2TokenWithIAMResponse;
+        };
+        sdk: {
+            input: IntrospectOAuth2TokenWithIAMCommandInput;
+            output: IntrospectOAuth2TokenWithIAMCommandOutput;
+        };
+    };
+}

package/dist-types/commands/RevokeOAuth2TokenWithIAMCommand.d.ts

@@ -0,0 +1,114 @@
+import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
+import type { RevokeOAuth2TokenWithIAMRequest, RevokeOAuth2TokenWithIAMResponse } from "../models/models_0";
+/**
+ * @public
+ */
+export type { __MetadataBearer };
+/**
+ * @public
+ *
+ * The input for {@link RevokeOAuth2TokenWithIAMCommand}.
+ */
+export interface RevokeOAuth2TokenWithIAMCommandInput extends RevokeOAuth2TokenWithIAMRequest {
+}
+/**
+ * @public
+ *
+ * The output of {@link RevokeOAuth2TokenWithIAMCommand}.
+ */
+export interface RevokeOAuth2TokenWithIAMCommandOutput extends RevokeOAuth2TokenWithIAMResponse, __MetadataBearer {
+}
+declare const RevokeOAuth2TokenWithIAMCommand_base: {
+    new (input: RevokeOAuth2TokenWithIAMCommandInput): import("@smithy/core/client").CommandImpl<RevokeOAuth2TokenWithIAMCommandInput, RevokeOAuth2TokenWithIAMCommandOutput, import("..").SigninClientResolvedConfig, import("..").ServiceInputTypes, import("..").ServiceOutputTypes>;
+    new (input: RevokeOAuth2TokenWithIAMCommandInput): import("@smithy/core/client").CommandImpl<RevokeOAuth2TokenWithIAMCommandInput, RevokeOAuth2TokenWithIAMCommandOutput, import("..").SigninClientResolvedConfig, import("..").ServiceInputTypes, import("..").ServiceOutputTypes>;
+    getEndpointParameterInstructions(): import("@smithy/types").EndpointParameterInstructions;
+};
+/**
+ * Grants permission to revoke an OAuth 2.0 refresh token and its associated refresh tokens
+ *
+ * Revokes a refresh_token issued by AWS Sign-In, invalidating the entire token
+ * chain so that the refresh_token can no longer be used to mint new access_tokens.
+ *
+ * Idempotency: revoking an already-revoked, expired, or otherwise invalid token
+ * still returns 200 OK with an empty body. Only the refresh_token type is accepted.
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { SigninClient, RevokeOAuth2TokenWithIAMCommand } from "@aws-sdk/client-signin"; // ES Modules import
+ * // const { SigninClient, RevokeOAuth2TokenWithIAMCommand } = require("@aws-sdk/client-signin"); // CommonJS import
+ * // import type { SigninClientConfig } from "@aws-sdk/client-signin";
+ * const config = {}; // type is SigninClientConfig
+ * const client = new SigninClient(config);
+ * const input = { // RevokeOAuth2TokenWithIAMRequest
+ *   token: "STRING_VALUE", // required
+ * };
+ * const command = new RevokeOAuth2TokenWithIAMCommand(input);
+ * const response = await client.send(command);
+ * // {};
+ *
+ * ```
+ *
+ * @param RevokeOAuth2TokenWithIAMCommandInput - {@link RevokeOAuth2TokenWithIAMCommandInput}
+ * @returns {@link RevokeOAuth2TokenWithIAMCommandOutput}
+ * @see {@link RevokeOAuth2TokenWithIAMCommandInput} for command's `input` shape.
+ * @see {@link RevokeOAuth2TokenWithIAMCommandOutput} for command's `response` shape.
+ * @see {@link SigninClientResolvedConfig | config} for SigninClient's `config` shape.
+ *
+ * @throws {@link AccessDeniedException} (client fault)
+ *  Error thrown for access denied scenarios with flexible HTTP status mapping
+ *
+ * Runtime HTTP Status Code Mapping:
+ * - HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
+ * - HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS
+ *
+ * The specific HTTP status code is determined at runtime based on the error enum value.
+ * Consumers should use the error field to determine the specific access denial reason.
+ *
+ * @throws {@link InternalServerException} (server fault)
+ *  Error thrown when an internal server error occurs
+ *
+ * HTTP Status Code: 500 Internal Server Error
+ *
+ * Used for unexpected server-side errors that prevent request processing.
+ *
+ * @throws {@link TooManyRequestsError} (client fault)
+ *  Error thrown when rate limit is exceeded
+ *
+ * HTTP Status Code: 429 Too Many Requests
+ *
+ * Possible OAuth2ErrorCode values:
+ * - INVALID_REQUEST: Rate limiting, too many requests, abuse prevention
+ *
+ * Possible causes:
+ * - Too many token requests from the same client
+ * - Rate limiting based on client_id or IP address
+ * - Abuse prevention mechanisms triggered
+ * - Service protection against excessive token generation
+ *
+ * @throws {@link ValidationException} (client fault)
+ *  Error thrown when request validation fails
+ *
+ * HTTP Status Code: 400 Bad Request
+ *
+ * Used for request validation errors such as malformed parameters,
+ * missing required fields, or invalid parameter values.
+ *
+ * @throws {@link SigninServiceException}
+ * <p>Base exception class for all service exceptions from Signin service.</p>
+ *
+ *
+ * @public
+ */
+export declare class RevokeOAuth2TokenWithIAMCommand extends RevokeOAuth2TokenWithIAMCommand_base {
+    /** @internal type navigation helper, not in runtime. */
+    protected static __types: {
+        api: {
+            input: RevokeOAuth2TokenWithIAMRequest;
+            output: {};
+        };
+        sdk: {
+            input: RevokeOAuth2TokenWithIAMCommandInput;
+            output: RevokeOAuth2TokenWithIAMCommandOutput;
+        };
+    };
+}

package/dist-types/commands/index.d.ts

@@ -1,8 +1,11 @@
 export * from "./CreateOAuth2TokenCommand";
+export * from "./CreateOAuth2TokenWithIAMCommand";
 export * from "./DeleteConsoleAuthorizationConfigurationCommand";
 export * from "./DeleteResourcePermissionStatementCommand";
 export * from "./GetConsoleAuthorizationConfigurationCommand";
 export * from "./GetResourcePolicyCommand";
+export * from "./IntrospectOAuth2TokenWithIAMCommand";
 export * from "./ListResourcePermissionStatementsCommand";
 export * from "./PutConsoleAuthorizationConfigurationCommand";
 export * from "./PutResourcePermissionStatementCommand";
+export * from "./RevokeOAuth2TokenWithIAMCommand";

package/dist-types/endpoint/EndpointParameters.d.ts

@@ -48,4 +48,5 @@ export interface EndpointParameters extends __EndpointParameters {
     Endpoint?: string | undefined;
     Region?: string | undefined;
     IsControlPlane?: boolean | undefined;
+    IsOAuthEndpoint?: boolean | undefined;
 }

package/dist-types/models/models_0.d.ts

@@ -1,9 +1,7 @@
 /**
  * AWS credentials structure containing temporary access credentials
  *
- * The scoped-down, 15 minute duration AWS credentials.
- * Scoping down will be based on CLI policy (CLI team needs to create it).
- * Similar to cloud shell implementation.
+ * Scoped, temporary AWS credentials with a 15-minute duration.
  * @public
  */
 export interface AccessToken {
@@ -140,6 +138,46 @@ export interface CreateOAuth2TokenResponse {
      */
     tokenOutput: CreateOAuth2TokenResponseBody | undefined;
 }
+/**
+ * Input structure for CreateOAuth2TokenWithIAM operation
+ * @public
+ */
+export interface CreateOAuth2TokenWithIAMRequest {
+    /**
+     * OAuth 2.0 grant type. Must be "client_credentials".
+     * @public
+     */
+    grantType: string | undefined;
+    /**
+     * The OAuth resource for which the access token is requested.
+     * Example: "aws-mcp.amazonaws.com".
+     * @public
+     */
+    resource: string | undefined;
+}
+/**
+ * Output structure for CreateOAuth2TokenWithIAM operation
+ *
+ * Contains the JWT access token, token type, and expiration per RFC 6749 §5.1.
+ * @public
+ */
+export interface CreateOAuth2TokenWithIAMResponse {
+    /**
+     * JWT access token containing principal identity, resource scope, and session metadata
+     * @public
+     */
+    accessToken: string | undefined;
+    /**
+     * Always "Bearer" per OAuth 2.1 specification
+     * @public
+     */
+    tokenType: string | undefined;
+    /**
+     * Token lifetime in seconds. Value is the minimum of session validity and 1 hour.
+     * @public
+     */
+    expiresIn: number | undefined;
+}
 /**
  * Input for DeleteConsoleAuthorizationConfiguration operation
  * @public
@@ -290,6 +328,117 @@ export interface GetResourcePolicyOutput {
      */
     signinResourceBasedPolicy: SigninResourceBasedPolicy | undefined;
 }
+/**
+ * Input structure for IntrospectOAuth2TokenWithIAM operation
+ *
+ * RFC 7662 §2.1 introspection request. Contains the token to inspect and an
+ * optional hint about the token's type.
+ * @public
+ */
+export interface IntrospectOAuth2TokenWithIAMRequest {
+    /**
+     * The string value of the token to introspect.
+     * May be either an access_token or a refresh_token issued by AWS Sign-In.
+     * @public
+     */
+    token: string | undefined;
+    /**
+     * Optional hint about the type of the token submitted for introspection.
+     * The server uses this hint to optimize lookup, but still falls back to
+     * the other token type on miss. Allowed values: access_token, refresh_token.
+     * @public
+     */
+    tokenTypeHint?: string | undefined;
+}
+/**
+ * Output structure for IntrospectOAuth2TokenWithIAM operation
+ *
+ * RFC 7662 §2.2 introspection response. Only `active` is required; all other
+ * claims are omitted when the token is inactive.
+ * @public
+ */
+export interface IntrospectOAuth2TokenWithIAMResponse {
+    /**
+     * Indicates whether the token is currently active. `true` only when the
+     * token is valid, has not expired, has not been revoked, and belongs to
+     * the caller's account.
+     * @public
+     */
+    active: boolean | undefined;
+    /**
+     * Client identifier for the OAuth 2.0 client that requested the token.
+     * @public
+     */
+    clientId?: string | undefined;
+    /**
+     * User identifier matching sts:GetCallerIdentity's `UserId` field for the
+     * token's subject principal (e.g. "AIDAEXAMPLE" for an IAM user, or
+     * "AROAEXAMPLE:session-name" for an assumed role).
+     * @public
+     */
+    userId?: string | undefined;
+    /**
+     * Indicates which kind of token was introspected.
+     * One of "access_token" or "refresh_token".
+     * @public
+     */
+    tokenType?: string | undefined;
+    /**
+     * Token expiration time as a NumericDate (Unix epoch seconds).
+     * @public
+     */
+    exp?: number | undefined;
+    /**
+     * Token issuance time as a NumericDate (Unix epoch seconds).
+     * @public
+     */
+    iat?: number | undefined;
+    /**
+     * Token "not before" time as a NumericDate (Unix epoch seconds).
+     * @public
+     */
+    nbf?: number | undefined;
+    /**
+     * Subject of the token: the IAM principal ARN. For assumed-role sessions,
+     * this is the session ARN (matches sts:GetCallerIdentity's `Arn` field),
+     * e.g. arn:aws:sts::123456789012:assumed-role/MyRole/session-name.
+     * @public
+     */
+    sub?: string | undefined;
+    /**
+     * Audience of the token: the OAuth resource the token is scoped to
+     * (for example, "aws-mcp.amazonaws.com"). Omitted for refresh tokens.
+     * @public
+     */
+    aud?: string | undefined;
+    /**
+     * Issuer of the token. Always "signin.amazonaws.com" for AWS Sign-In.
+     * @public
+     */
+    iss?: string | undefined;
+    /**
+     * Unique identifier for the token.
+     * @public
+     */
+    jti?: string | undefined;
+    /**
+     * 12-digit AWS account ID of the token's subject principal.
+     * @public
+     */
+    accountId?: string | undefined;
+    /**
+     * AWS Sign-In session ARN bound to the token, of the form
+     * arn:aws:signin:\{region\}:\{account\}:session/\{uuid\}.
+     * @public
+     */
+    signinSession?: string | undefined;
+    /**
+     * The OAuth resource the token is scoped to during Human OAuth flow.
+     * Only present for refresh token introspection.
+     * @public
+     */
+    resource?: string | undefined;
+}
 /**
  * Input for ListResourcePermissionStatements operation
  * @public
@@ -428,3 +577,26 @@ export interface PutResourcePermissionStatementOutput {
      */
     statementId: string | undefined;
 }
+/**
+ * Input structure for RevokeOAuth2TokenWithIAM operation
+ *
+ * RFC 7009 §2.1 revocation request. Contains the refresh_token to revoke.
+ * @public
+ */
+export interface RevokeOAuth2TokenWithIAMRequest {
+    /**
+     * The refresh_token to revoke. Must be a refresh_token issued by AWS
+     * Sign-In (prefix "ASOR"); access_tokens are not accepted for revocation.
+     * @public
+     */
+    token: string | undefined;
+}
+/**
+ * Output structure for RevokeOAuth2TokenWithIAM operation
+ *
+ * RFC 7009 §2.2 revocation response. The endpoint returns 200 OK with an
+ * empty body on success; there are no response fields.
+ * @public
+ */
+export interface RevokeOAuth2TokenWithIAMResponse {
+}

package/dist-types/schemas/schemas_0.d.ts

@@ -19,6 +19,8 @@ export declare var CreateOAuth2TokenRequest$: StaticStructureSchema;
 export declare var CreateOAuth2TokenRequestBody$: StaticStructureSchema;
 export declare var CreateOAuth2TokenResponse$: StaticStructureSchema;
 export declare var CreateOAuth2TokenResponseBody$: StaticStructureSchema;
+export declare var CreateOAuth2TokenWithIAMRequest$: StaticStructureSchema;
+export declare var CreateOAuth2TokenWithIAMResponse$: StaticStructureSchema;
 export declare var DeleteConsoleAuthorizationConfigurationInput$: StaticStructureSchema;
 export declare var DeleteConsoleAuthorizationConfigurationOutput$: StaticStructureSchema;
 export declare var DeleteResourcePermissionStatementInput$: StaticStructureSchema;
@@ -27,6 +29,8 @@ export declare var GetConsoleAuthorizationConfigurationInput$: StaticStructureSc
 export declare var GetConsoleAuthorizationConfigurationOutput$: StaticStructureSchema;
 export declare var GetResourcePolicyInput$: StaticStructureSchema;
 export declare var GetResourcePolicyOutput$: StaticStructureSchema;
+export declare var IntrospectOAuth2TokenWithIAMRequest$: StaticStructureSchema;
+export declare var IntrospectOAuth2TokenWithIAMResponse$: StaticStructureSchema;
 export declare var ListResourcePermissionStatementsInput$: StaticStructureSchema;
 export declare var ListResourcePermissionStatementsOutput$: StaticStructureSchema;
 export declare var PermissionStatementSummary$: StaticStructureSchema;
@@ -35,12 +39,17 @@ export declare var PutConsoleAuthorizationConfigurationInput$: StaticStructureSc
 export declare var PutConsoleAuthorizationConfigurationOutput$: StaticStructureSchema;
 export declare var PutResourcePermissionStatementInput$: StaticStructureSchema;
 export declare var PutResourcePermissionStatementOutput$: StaticStructureSchema;
+export declare var RevokeOAuth2TokenWithIAMRequest$: StaticStructureSchema;
+export declare var RevokeOAuth2TokenWithIAMResponse$: StaticStructureSchema;
 export declare var SigninResourceBasedPolicy$: StaticStructureSchema;
 export declare var CreateOAuth2Token$: StaticOperationSchema;
+export declare var CreateOAuth2TokenWithIAM$: StaticOperationSchema;
 export declare var DeleteConsoleAuthorizationConfiguration$: StaticOperationSchema;
 export declare var DeleteResourcePermissionStatement$: StaticOperationSchema;
 export declare var GetConsoleAuthorizationConfiguration$: StaticOperationSchema;
 export declare var GetResourcePolicy$: StaticOperationSchema;
+export declare var IntrospectOAuth2TokenWithIAM$: StaticOperationSchema;
 export declare var ListResourcePermissionStatements$: StaticOperationSchema;
 export declare var PutConsoleAuthorizationConfiguration$: StaticOperationSchema;
 export declare var PutResourcePermissionStatement$: StaticOperationSchema;
+export declare var RevokeOAuth2TokenWithIAM$: StaticOperationSchema;

package/dist-types/ts3.4/Signin.d.ts

@@ -7,6 +7,10 @@ import {
   CreateOAuth2TokenCommandInput,
   CreateOAuth2TokenCommandOutput,
 } from "./commands/CreateOAuth2TokenCommand";
+import {
+  CreateOAuth2TokenWithIAMCommandInput,
+  CreateOAuth2TokenWithIAMCommandOutput,
+} from "./commands/CreateOAuth2TokenWithIAMCommand";
 import {
   DeleteConsoleAuthorizationConfigurationCommandInput,
   DeleteConsoleAuthorizationConfigurationCommandOutput,
@@ -23,6 +27,10 @@ import {
   GetResourcePolicyCommandInput,
   GetResourcePolicyCommandOutput,
 } from "./commands/GetResourcePolicyCommand";
+import {
+  IntrospectOAuth2TokenWithIAMCommandInput,
+  IntrospectOAuth2TokenWithIAMCommandOutput,
+} from "./commands/IntrospectOAuth2TokenWithIAMCommand";
 import {
   ListResourcePermissionStatementsCommandInput,
   ListResourcePermissionStatementsCommandOutput,
@@ -35,6 +43,10 @@ import {
   PutResourcePermissionStatementCommandInput,
   PutResourcePermissionStatementCommandOutput,
 } from "./commands/PutResourcePermissionStatementCommand";
+import {
+  RevokeOAuth2TokenWithIAMCommandInput,
+  RevokeOAuth2TokenWithIAMCommandOutput,
+} from "./commands/RevokeOAuth2TokenWithIAMCommand";
 import { SigninClient } from "./SigninClient";
 export interface Signin {
   createOAuth2Token(
@@ -50,6 +62,19 @@ export interface Signin {
     options: __HttpHandlerOptions,
     cb: (err: any, data?: CreateOAuth2TokenCommandOutput) => void
   ): void;
+  createOAuth2TokenWithIAM(
+    args: CreateOAuth2TokenWithIAMCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<CreateOAuth2TokenWithIAMCommandOutput>;
+  createOAuth2TokenWithIAM(
+    args: CreateOAuth2TokenWithIAMCommandInput,
+    cb: (err: any, data?: CreateOAuth2TokenWithIAMCommandOutput) => void
+  ): void;
+  createOAuth2TokenWithIAM(
+    args: CreateOAuth2TokenWithIAMCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: CreateOAuth2TokenWithIAMCommandOutput) => void
+  ): void;
   deleteConsoleAuthorizationConfiguration(): Promise<DeleteConsoleAuthorizationConfigurationCommandOutput>;
   deleteConsoleAuthorizationConfiguration(
     args: DeleteConsoleAuthorizationConfigurationCommandInput,
@@ -123,6 +148,19 @@ export interface Signin {
     options: __HttpHandlerOptions,
     cb: (err: any, data?: GetResourcePolicyCommandOutput) => void
   ): void;
+  introspectOAuth2TokenWithIAM(
+    args: IntrospectOAuth2TokenWithIAMCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<IntrospectOAuth2TokenWithIAMCommandOutput>;
+  introspectOAuth2TokenWithIAM(
+    args: IntrospectOAuth2TokenWithIAMCommandInput,
+    cb: (err: any, data?: IntrospectOAuth2TokenWithIAMCommandOutput) => void
+  ): void;
+  introspectOAuth2TokenWithIAM(
+    args: IntrospectOAuth2TokenWithIAMCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: IntrospectOAuth2TokenWithIAMCommandOutput) => void
+  ): void;
   listResourcePermissionStatements(): Promise<ListResourcePermissionStatementsCommandOutput>;
   listResourcePermissionStatements(
     args: ListResourcePermissionStatementsCommandInput,
@@ -171,6 +209,19 @@ export interface Signin {
     options: __HttpHandlerOptions,
     cb: (err: any, data?: PutResourcePermissionStatementCommandOutput) => void
   ): void;
+  revokeOAuth2TokenWithIAM(
+    args: RevokeOAuth2TokenWithIAMCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<RevokeOAuth2TokenWithIAMCommandOutput>;
+  revokeOAuth2TokenWithIAM(
+    args: RevokeOAuth2TokenWithIAMCommandInput,
+    cb: (err: any, data?: RevokeOAuth2TokenWithIAMCommandOutput) => void
+  ): void;
+  revokeOAuth2TokenWithIAM(
+    args: RevokeOAuth2TokenWithIAMCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: RevokeOAuth2TokenWithIAMCommandOutput) => void
+  ): void;
   paginateListResourcePermissionStatements(
     args?: ListResourcePermissionStatementsCommandInput,
     paginationConfig?: Pick<

package/dist-types/ts3.4/SigninClient.d.ts

@@ -40,6 +40,10 @@ import {
   CreateOAuth2TokenCommandInput,
   CreateOAuth2TokenCommandOutput,
 } from "./commands/CreateOAuth2TokenCommand";
+import {
+  CreateOAuth2TokenWithIAMCommandInput,
+  CreateOAuth2TokenWithIAMCommandOutput,
+} from "./commands/CreateOAuth2TokenWithIAMCommand";
 import {
   DeleteConsoleAuthorizationConfigurationCommandInput,
   DeleteConsoleAuthorizationConfigurationCommandOutput,
@@ -56,6 +60,10 @@ import {
   GetResourcePolicyCommandInput,
   GetResourcePolicyCommandOutput,
 } from "./commands/GetResourcePolicyCommand";
+import {
+  IntrospectOAuth2TokenWithIAMCommandInput,
+  IntrospectOAuth2TokenWithIAMCommandOutput,
+} from "./commands/IntrospectOAuth2TokenWithIAMCommand";
 import {
   ListResourcePermissionStatementsCommandInput,
   ListResourcePermissionStatementsCommandOutput,
@@ -68,6 +76,10 @@ import {
   PutResourcePermissionStatementCommandInput,
   PutResourcePermissionStatementCommandOutput,
 } from "./commands/PutResourcePermissionStatementCommand";
+import {
+  RevokeOAuth2TokenWithIAMCommandInput,
+  RevokeOAuth2TokenWithIAMCommandOutput,
+} from "./commands/RevokeOAuth2TokenWithIAMCommand";
 import {
   ClientInputEndpointParameters,
   ClientResolvedEndpointParameters,
@@ -77,22 +89,28 @@ import { RuntimeExtension, RuntimeExtensionsConfig } from "./runtimeExtensions";
 export { __Client };
 export type ServiceInputTypes =
   | CreateOAuth2TokenCommandInput
+  | CreateOAuth2TokenWithIAMCommandInput
   | DeleteConsoleAuthorizationConfigurationCommandInput
   | DeleteResourcePermissionStatementCommandInput
   | GetConsoleAuthorizationConfigurationCommandInput
   | GetResourcePolicyCommandInput
+  | IntrospectOAuth2TokenWithIAMCommandInput
   | ListResourcePermissionStatementsCommandInput
   | PutConsoleAuthorizationConfigurationCommandInput
-  | PutResourcePermissionStatementCommandInput;
+  | PutResourcePermissionStatementCommandInput
+  | RevokeOAuth2TokenWithIAMCommandInput;
 export type ServiceOutputTypes =
   | CreateOAuth2TokenCommandOutput
+  | CreateOAuth2TokenWithIAMCommandOutput
   | DeleteConsoleAuthorizationConfigurationCommandOutput
   | DeleteResourcePermissionStatementCommandOutput
   | GetConsoleAuthorizationConfigurationCommandOutput
   | GetResourcePolicyCommandOutput
+  | IntrospectOAuth2TokenWithIAMCommandOutput
   | ListResourcePermissionStatementsCommandOutput
   | PutConsoleAuthorizationConfigurationCommandOutput
-  | PutResourcePermissionStatementCommandOutput;
+  | PutResourcePermissionStatementCommandOutput
+  | RevokeOAuth2TokenWithIAMCommandOutput;
 export interface ClientDefaults
   extends Partial<__SmithyConfiguration<__HttpHandlerOptions>> {
   requestHandler?: __HttpHandlerUserInput;

package/dist-types/ts3.4/commandBuilder.d.ts

@@ -39,6 +39,7 @@ export declare const command: <
 };
 export declare const _ep0: EndpointParameterInstructions;
 export declare const _ep1: EndpointParameterInstructions;
+export declare const _ep2: EndpointParameterInstructions;
 export declare const _mw0: (
   Command: any,
   cs: any,