IAM

Roles, role assignments, access policies and effective permissions from Equinix Access Management.

Scope#

The IAM domain reads and manages authorization in Equinix Access Management, that is, the roles that each principal holds on each resource.

Accessor	Covers
`roles()`	Roles, organization-wide and per project
`roleAssignments()`	Assignments of a role to a principal on a resource: list, create, get, delete
`accessPolicies()`	Access policies and their grants
`permissionSets()`	Permission sets
`principalPolicies()`, `policyMasks()`	Principal policies and masks
`effectivePermissions()`	The permissions a principal ends up with on a resource
`resourceTypes()`	Resource types and their actions

The SDK sends IAM requests to https://access.eqix.equinix.com. Release 3.0.0 sent them to api.equinix.com, which answers 404. On 2026-11-11 roles().list() returned 200 with 79 roles through the 4.0 tree.

Token type per endpoint#

Endpoint group	Accepted token
Organization-level reads such as `roles().list()`	Client-credentials token
Project-scoped endpoints: `roles().listByProject(...)`, `principalPolicies()`	Access-policy token from STS only

A client-credentials token sent to a project-scoped endpoint is answered with "only supported when using an access-policy auth token". Those calls need a client built with a BearerTokenProvider.

Reads#

Java

import com.eqixiac.equinix.iam.model.json.RoleAssignmentList;
import com.eqixiac.equinix.iam.model.json.RoleList;

RoleList roles = iam.roles().list();
roles.getList().forEach(role -> System.out.println(role.getName()));
while (roles.getNextPageToken() != null) {
    roles = iam.roles().list(roles.getNextPageToken(), 50, null);
    roles.getList().forEach(role -> System.out.println(role.getName()));
}

RoleAssignmentList assignments = iam.roleAssignments().list(projectId, "PROJECT");

IAM lists return a page object with a next-page token, as described under Pagination.

Project identifiers#

Project-scoped paths take the project in the form project:<uuid>. ProjectIds.of(uuid) adds the prefix and ProjectIds.bare(value) removes it, so a caller can pass either form.

Java

import com.eqixiac.equinix.IAM;
import com.eqixiac.equinix.core.auth.BearerTokenProvider;
import com.eqixiac.equinix.iam.client.ProjectIds;

IAM scoped = new IAM(BearerTokenProvider.of(accessPolicyToken));
RoleList projectRoles = scoped.roles().listByProject(ProjectIds.of(projectId));

Access review#

A periodic access review needs the assignments per project and the role each one grants. The following loop prints one line per assignment for every project the credential can see.

Java

import com.eqixiac.equinix.projects.model.Project;

for (Project project : projects.projects().list()) {
    RoleAssignmentList page = iam.roleAssignments().list(project.getProjectId(), "PROJECT");
    page.getList().forEach(assignment ->
        System.out.println(project.getProjectName() + ": " + assignment));
}

effectivePermissions().get(...) returns the permissions that one principal has on one resource after policies and masks are applied.