- Product Introduction
- Purchase Guide
- Getting Started
- User Guide
- Overview
- Users
- Access Key
- User Groups
- Role
- Identity Provider
- SSO Overview
- Practical Scenarios for SSO
- User-Based SSO
- Role-Based SSO
- Overview
- Overview of SAML Role-Based SSO
- Overview of OIDC Role-Based Single Sign-On
- SAML 2.0-Based Federation
- Accessing Tencent Cloud Console as SAML 2.0 Federated Users
- Creating a SAML IdP
- Creating an OIDC Identity Provider
- Managing IdPs
- Azure Active Directory Single Sign-On
- OneLogin Single Sign-On
- Okta Single Sign-On
- ADFS SSO to Tencent Cloud
- Implementing OIDC-Based Role-Based SSO
- Policies
- Permissions Boundary
- Troubleshooting
- Downloading Security Analysis Report
- CAM-Enabled Role
- Overview
- Compute
- Container
- Microservice
- Essential Storage Service
- Data Process and Analysis
- Data Migration
- Relational Database
- Enterprise Distributed DBMS
- NoSQL Database
- Database SaaS Tool
- Networking
- CDN and Acceleration
- Network Security
- Data Security
- Application Security
- Domains & Websites
- Big Data
- Middleware
- Interactive Video Services
- Media On-Demand
- Cloud Real-time Rendering
- Game Services
- Cloud Resource Management
- Management and Audit Tools
- Monitor and Operation
- CAM-Enabled API
- Overview
- Compute
- Edge Computing
- Container
- Distributed cloud
- Microservice
- Serverless
- Essential Storage Service
- Data Process and Analysis
- Data Migration
- Relational Database
- Enterprise Distributed DBMS
- NoSQL Database
- Database SaaS Tool
- Networking
- CDN and Acceleration
- Network Security
- Endpoint Security
- Data Security
- Business Security
- Application Security
- Domains & Websites
- Big Data
- Voice Technology
- Image Creation
- AI Platform Service
- Natural Language Processing
- Optical Character Recognition
- Middleware
- Communication
- Interactive Video Services
- Stream Services
- Media On-Demand
- Media Process Services
- Cloud Real-time Rendering
- Game Services
- Education Sevices
- Cloud Resource Management
- Management and Audit Tools
- Monitor and Operation
- More
- Practical Tutorial
- Security Practical Tutorial
- Multi-Identity Personnel Permission Management
- Authorizing Certain Operations by Tag
- Supporting Isolated Resource Access for Employees
- Enterprise Multi-Account Permissions Management
- Reviewing Employee Operation Records on Tencent Cloud
- Implementing Attribute-Based Access Control for Employee Resource Permissions Management
- During tag-based authentication, only tag key matching is supported
- Business Use Cases
- TencentDB for MySQL
- CLB
- CMQ
- COS
- Authorizing Sub-account Full Access to Specific Directory
- Authorizing Sub-account Read-only Access to Files in Specific Directory
- Authorizing Sub-account Read/Write Access to Specific File
- Authorizing Sub-account Read-only Access to COS Resources
- Authorizing a Sub-account Read/Write Access to All Files in Specified Directory Except Specified Files
- Authorizing Sub-account Read/Write Access to Files with Specified Prefix
- Authorizing Another Account Read/Write Access to Specific Files
- Authorizing Cross-Account ’s Sub-account Read/Write Access to Specified File
- Authorizing Sub-account Full Access to COS Resources under the Account
- CVM
- Authorizing Sub-account Full Access to CVMs
- Authorizing Sub-account Read-only Access to CVMs
- Authorizing Sub-account Read-only Access to CVM-related Resources
- Authorizing Sub-account Access to Perform Operations on CBSs
- Authorizing Sub-account Access to Perform Operations on Security Groups
- Authorizing Sub-account Access to Perform Operations on EIPs
- Authorizing Sub-account Access to Perform Operations on Specific CVM
- Authorizing Sub-account Access to Perform Operations on CVMs in Specific Region
- Authorizing Sub-account Full Access to CVMs Except Payment
- VPC
- Authorizing Sub-account Access to Perform Operations on Specific VPC and Resources of This VPC
- Authorizing Sub-account Access to Perform Operations on VPC Except on Routing Table
- Authorizing Sub-account Access to Perform Operations on VPN
- Authorizing Sub-account Full Access to VPCs
- Authorizing a Sub-account Full Access to VPCs Except Payment
- Authorizing Sub-account Read-only Access to VPCs
- VOD
- Others
- API Documentation
- History
- Introduction
- API Category
- User APIs
- DescribeSafeAuthFlagColl
- CreateGroup
- UpdateUser
- UpdateGroup
- RemoveUserFromGroup
- ListUsersForGroup
- ListUsers
- ListGroupsForUser
- ListGroups
- GetUser
- GetGroup
- DeleteUser
- DeleteGroup
- AddUserToGroup
- AddUser
- SetMfaFlag
- GetCustomMFATokenInfo
- ConsumeCustomMFAToken
- ListCollaborators
- ListAccessKeys
- PutUserPermissionsBoundary
- DeleteUserPermissionsBoundary
- DescribeSubAccounts
- GetSecurityLastUsed
- GetAccountSummary
- GetUserAppId
- UpdateAccessKey
- DeleteAccessKey
- CreateAccessKey
- Making API Requests
- Identity Provider APIs
- Policy APIs
- UpdatePolicy
- ListPolicies
- ListEntitiesForPolicy
- ListAttachedUserPolicies
- ListAttachedGroupPolicies
- GetPolicy
- DetachUserPolicy
- DetachGroupPolicy
- DeletePolicy
- CreatePolicy
- AttachUserPolicy
- AttachGroupPolicy
- SetDefaultPolicyVersion
- ListPolicyVersions
- GetPolicyVersion
- DeletePolicyVersion
- CreatePolicyVersion
- ListAttachedUserAllPolicies
- Role APIs
- UpdateRoleDescription
- UpdateAssumeRolePolicy
- ListAttachedRolePolicies
- GetRole
- DetachRolePolicy
- DescribeRoleList
- DeleteRole
- CreateRole
- AttachRolePolicy
- UpdateRoleConsoleLogin
- GetServiceLinkedRoleDeletionStatus
- DeleteServiceLinkedRole
- CreateServiceLinkedRole
- PutRolePermissionsBoundary
- DeleteRolePermissionsBoundary
- DescribeSafeAuthFlag
- DescribeSafeAuthFlagIntl
- UntagRole
- TagRole
- Data Types
- Error Codes
- FAQs
- Glossary
- Product Introduction
- Purchase Guide
- Getting Started
- User Guide
- Overview
- Users
- Access Key
- User Groups
- Role
- Identity Provider
- SSO Overview
- Practical Scenarios for SSO
- User-Based SSO
- Role-Based SSO
- Overview
- Overview of SAML Role-Based SSO
- Overview of OIDC Role-Based Single Sign-On
- SAML 2.0-Based Federation
- Accessing Tencent Cloud Console as SAML 2.0 Federated Users
- Creating a SAML IdP
- Creating an OIDC Identity Provider
- Managing IdPs
- Azure Active Directory Single Sign-On
- OneLogin Single Sign-On
- Okta Single Sign-On
- ADFS SSO to Tencent Cloud
- Implementing OIDC-Based Role-Based SSO
- Policies
- Permissions Boundary
- Troubleshooting
- Downloading Security Analysis Report
- CAM-Enabled Role
- Overview
- Compute
- Container
- Microservice
- Essential Storage Service
- Data Process and Analysis
- Data Migration
- Relational Database
- Enterprise Distributed DBMS
- NoSQL Database
- Database SaaS Tool
- Networking
- CDN and Acceleration
- Network Security
- Data Security
- Application Security
- Domains & Websites
- Big Data
- Middleware
- Interactive Video Services
- Media On-Demand
- Cloud Real-time Rendering
- Game Services
- Cloud Resource Management
- Management and Audit Tools
- Monitor and Operation
- CAM-Enabled API
- Overview
- Compute
- Edge Computing
- Container
- Distributed cloud
- Microservice
- Serverless
- Essential Storage Service
- Data Process and Analysis
- Data Migration
- Relational Database
- Enterprise Distributed DBMS
- NoSQL Database
- Database SaaS Tool
- Networking
- CDN and Acceleration
- Network Security
- Endpoint Security
- Data Security
- Business Security
- Application Security
- Domains & Websites
- Big Data
- Voice Technology
- Image Creation
- AI Platform Service
- Natural Language Processing
- Optical Character Recognition
- Middleware
- Communication
- Interactive Video Services
- Stream Services
- Media On-Demand
- Media Process Services
- Cloud Real-time Rendering
- Game Services
- Education Sevices
- Cloud Resource Management
- Management and Audit Tools
- Monitor and Operation
- More
- Practical Tutorial
- Security Practical Tutorial
- Multi-Identity Personnel Permission Management
- Authorizing Certain Operations by Tag
- Supporting Isolated Resource Access for Employees
- Enterprise Multi-Account Permissions Management
- Reviewing Employee Operation Records on Tencent Cloud
- Implementing Attribute-Based Access Control for Employee Resource Permissions Management
- During tag-based authentication, only tag key matching is supported
- Business Use Cases
- TencentDB for MySQL
- CLB
- CMQ
- COS
- Authorizing Sub-account Full Access to Specific Directory
- Authorizing Sub-account Read-only Access to Files in Specific Directory
- Authorizing Sub-account Read/Write Access to Specific File
- Authorizing Sub-account Read-only Access to COS Resources
- Authorizing a Sub-account Read/Write Access to All Files in Specified Directory Except Specified Files
- Authorizing Sub-account Read/Write Access to Files with Specified Prefix
- Authorizing Another Account Read/Write Access to Specific Files
- Authorizing Cross-Account ’s Sub-account Read/Write Access to Specified File
- Authorizing Sub-account Full Access to COS Resources under the Account
- CVM
- Authorizing Sub-account Full Access to CVMs
- Authorizing Sub-account Read-only Access to CVMs
- Authorizing Sub-account Read-only Access to CVM-related Resources
- Authorizing Sub-account Access to Perform Operations on CBSs
- Authorizing Sub-account Access to Perform Operations on Security Groups
- Authorizing Sub-account Access to Perform Operations on EIPs
- Authorizing Sub-account Access to Perform Operations on Specific CVM
- Authorizing Sub-account Access to Perform Operations on CVMs in Specific Region
- Authorizing Sub-account Full Access to CVMs Except Payment
- VPC
- Authorizing Sub-account Access to Perform Operations on Specific VPC and Resources of This VPC
- Authorizing Sub-account Access to Perform Operations on VPC Except on Routing Table
- Authorizing Sub-account Access to Perform Operations on VPN
- Authorizing Sub-account Full Access to VPCs
- Authorizing a Sub-account Full Access to VPCs Except Payment
- Authorizing Sub-account Read-only Access to VPCs
- VOD
- Others
- API Documentation
- History
- Introduction
- API Category
- User APIs
- DescribeSafeAuthFlagColl
- CreateGroup
- UpdateUser
- UpdateGroup
- RemoveUserFromGroup
- ListUsersForGroup
- ListUsers
- ListGroupsForUser
- ListGroups
- GetUser
- GetGroup
- DeleteUser
- DeleteGroup
- AddUserToGroup
- AddUser
- SetMfaFlag
- GetCustomMFATokenInfo
- ConsumeCustomMFAToken
- ListCollaborators
- ListAccessKeys
- PutUserPermissionsBoundary
- DeleteUserPermissionsBoundary
- DescribeSubAccounts
- GetSecurityLastUsed
- GetAccountSummary
- GetUserAppId
- UpdateAccessKey
- DeleteAccessKey
- CreateAccessKey
- Making API Requests
- Identity Provider APIs
- Policy APIs
- UpdatePolicy
- ListPolicies
- ListEntitiesForPolicy
- ListAttachedUserPolicies
- ListAttachedGroupPolicies
- GetPolicy
- DetachUserPolicy
- DetachGroupPolicy
- DeletePolicy
- CreatePolicy
- AttachUserPolicy
- AttachGroupPolicy
- SetDefaultPolicyVersion
- ListPolicyVersions
- GetPolicyVersion
- DeletePolicyVersion
- CreatePolicyVersion
- ListAttachedUserAllPolicies
- Role APIs
- UpdateRoleDescription
- UpdateAssumeRolePolicy
- ListAttachedRolePolicies
- GetRole
- DetachRolePolicy
- DescribeRoleList
- DeleteRole
- CreateRole
- AttachRolePolicy
- UpdateRoleConsoleLogin
- GetServiceLinkedRoleDeletionStatus
- DeleteServiceLinkedRole
- CreateServiceLinkedRole
- PutRolePermissionsBoundary
- DeleteRolePermissionsBoundary
- DescribeSafeAuthFlag
- DescribeSafeAuthFlagIntl
- UntagRole
- TagRole
- Data Types
- Error Codes
- FAQs
- Glossary
Fundamental information
| Product | Abbreviation in CAM | Console | Authorization by Tag | Authorization Granularity | IP Restriction |
|---|---|---|---|---|---|
| Automatic Speech Recognition | asr | Supported | Supported | Resource level | Partially supported |
Note：
The authorization granularity of cloud products is divided into three levels: service level, operation level, and resource level, based on the degree of granularity.
- Service level: It defines whether a user has the permission to access the service as a whole. A user can have either full access or no access to the service. For the authorization granularity of cloud products at service level, the authorization of specific APIs are not supported.
- Operation level: It defines whether a user has the permission to call a specific API of the service. For example, granting an account read-only access to the CVM service is an authorization at the operation level.
- Resource level: It is the finest authorization granularity which defines whether a user has the permission to access specific resources. For example, granting an account read/write access to a specific CVM instance is an authorization at the resource level.
API authorization granularity
Two authorization granularity levels of API are supported: resource level, and operation level.
- Resource level: It supports the authorization of a specific resource.
- Operation level: It does not support the authorization of a specific resource. If the policy syntax restricts a specific resource during authorization, CAM will determine that this API is not within the scope of authorization, and deem it as unauthorized.
Write operations
| API | API Description | Authorization Granularity | Six-segment Resource Description | IP Restriction |
|---|---|---|---|---|
| ActivateAuth | Offline device authorization device activation interface | Resource level | qcs::asr::uin/${uin}:subUin/${uin} | Supported |
| ActivateService | Activate service | Operation level | * | Supported |
| CreateAsrKeyWordLib | Create a Keyword Library | Resource level | qcs::asr::uin/$account:keyWord/$keyWordLibID | Supported |
| CreateAsrUser | CreateAsrUser | Operation level | * | Supported |
| CreateAsrVocab | Create a vocab table | Resource level | qcs::asr::uin/$account:vocab/$vocabId | Supported |
| CreateCosRecognize | Create Cos Recognize | Operation level | * | Supported |
| CreateCustomization | Create customization model | Resource level | qcs::asr::uin/${uin}:model/$modelId | Supported |
| CreateModel | Create a customization model | Resource level | qcs::asr::uin/${uin}:model/$modelId | not supported |
| CreateRecTask | Speech-to-text for recording files. | Operation level | * | Supported |
| CreateVocalRemoverIsolationTask | Create vocal romover and lsolation task | Operation level | * | Supported |
| DeleteAsrKeyWordLib | Delete a ASR keyword library | Resource level | qcs::asr::uin/$account:keyWordLib/$keyWordLibId | Supported |
| DeleteAsrVocab | Delete a ASR vocab table | Resource level | qcs::asr::uin/${uin}:subUin/${uin} | Supported |
| DeleteCustomization | Delete customization model | Resource level | qcs::asr::uin/${uin}:subUin/${uin} | Supported |
| DeleteModel | Delete a customiztion model | Resource level | qcs::asr::uin/${uin}:model/$modelId | not supported |
| DeleteModelsByAppid | Delete customiztion model according appid | Resource level | qcs::asr::uin/${uin}:model/$modelId | not supported |
| DeleteRecognizeRecord | Delete identification records from the console | Operation level | * | Supported |
| InvokeSDKFunction | Offline SDK console interface | Resource level | qcs::asr::uin/${uin}:subUin/${uin} | Supported |
| ModifyCustomization | Modify Customization Model | Resource level | qcs::asr::uin/${uin}:subUin/${uin} | Supported |
| ModifyCustomizationState | Modify customization model state | Resource level | qcs::asr::uin/${uin}:model/$modelId | Supported |
| ModifyModel | Modify customization model | Resource level | qcs::asr::uin/${uin}:model/$modelId | not supported |
| ModifyModelState | Modify customization model state | Resource level | qcs::asr::uin/${uin}:model/$modelId | not supported |
| SetPayMode | Set pay mode | Operation level | * | Supported |
| SetVocabState | Set vocab table state | Resource level | qcs::asr::uin/${uin}:vocab/$vocabId | Supported |
| UpdateAsrKeyWordLib | Update a Keyword Library | Resource level | qcs::asr::uin/$account:keyWordLib/$keyWordLibId | Supported |
| UpdateAsrVocab | Update a vocab info | Resource level | qcs::asr::uin/$account:vocab/$vocabId | Supported |
| VoicePrintDelete | Speaker deleted | Operation level | * | Supported |
| VoicePrintEnroll | Speaker registration | Operation level | * | Supported |
| VoicePrintUpdate | voiceprint update | Operation level | * | Supported |
Read operations
| API | API Description | Authorization Granularity | Six-segment Resource Description | IP Restriction |
|---|---|---|---|---|
| CloseAsyncRecognitionTask | Voice stream asynchronous recognition task shutdown | Operation level | * | Supported |
| CreateAsyncRecognitionTask | Voice stream asynchronous recognition task creation | Operation level | * | Supported |
| DescribeAsyncRecognitionTasks | Voice stream asynchronous recognition task list | Operation level | * | Supported |
| DescribeDictName | Describe customiztion model dict | Resource level | qcs::asr::uin/${uin}:model/$modelId | not supported |
| DescribeHotNews | Describe Hot News | Operation level | * | not supported |
| DescribeOpenStatus | Console query service activation status | Operation level | * | Supported |
| DescribePidOrders | Describe pid resource list | Operation level | * | Supported |
| DescribeQuotaPkgs | Describe qps quota package | Operation level | * | Supported |
| DescribeRecognizeProgress | DescribeRecognizeProgress | Operation level | * | Supported |
| DescribeRecordRecognizeTask | Describe Record Recognize Task | Operation level | * | Supported |
| DescribeResource | Describe resource package info | Operation level | * | Supported |
| DescribeStatInfo | Describe Interface Statistic Info | Resource level | qcs::asr::uin/${uin}:subUin/${subUin} | Supported |
| DescribeStatInfoUrl | Describe Download Url Of Interface Statistic Info | Resource level | qcs::asr::uin/${uin}:subUin/${subUin} | Supported |
| DescribeStatistics | Operation level | * | Supported | |
| DescribeStsCosCredential | Describe Sts Cos Credential | Operation level | * | not supported |
| DescribeTaskStatus | Get result of speech-to-text for recording files. | Operation level | * | Supported |
| DescribeUserStatus | Search user status. | Operation level | * | not supported |
| DescribeVocalRemoverIsolationTaskStatus | Sound companion separation result query | Operation level | * | Supported |
| DownloadAsrVocab | Download a ASR vocab table | Resource level | qcs::asr::uin/${uin}:subUin/${uin} | Supported |
| DownloadCustomization | Download customization model | Resource level | qcs::asr::uin/${uin}:subUin/${uin} | Supported |
| DownloadModel | Download customization model | Resource level | qcs::asr::uin/${uin}:model/$modelId | not supported |
| FlashRecognition | Flash Recognition | Operation level | * | not supported |
| GetAsrVocab | Get a vocab table | Resource level | qcs::asr::uin/${uin}:subUin/${uin} | Supported |
| GetCustomizationUserLimit | Get customization model limit | Operation level | * | Supported |
| GetModelInfo | get model info | Resource level | qcs::asr::uin/${uin}:subUin/${uin} | Supported |
| GetQpsQuota | Describe QPS quota | Operation level | * | Supported |
| GetQpsStatistics | Describe QPS Statistics Data | Operation level | * | Supported |
| GetQpsStatisticsUrl | Describe QPS statistic data download url | Operation level | * | Supported |
| GetQuotaConfig | Describe quota config | Operation level | * | Supported |
| GetRecognizeCosUrl | Get a recognizable cos link | Operation level | * | Supported |
| GetRecognizeRecord | Obtaining Console Identification Records | Operation level | * | Supported |
| LanguageIdentify | LanguageIdentify | Operation level | * | Supported |
| RealtimeRecognition | Speech-to-text for voice streaming data. | Operation level | * | not supported |
| SentenceRecognition | Sentence Recognition | Operation level | * | Supported |
| VoicePrintCount | Speaker statistics | Operation level | * | Supported |
| VoicePrintGroupVerify | Speaker verification 1:N | Operation level | * | Supported |
| VoicePrintVerify | speaker authentication | Operation level | * | Supported |
List Operations
| API | API Description | Authorization Granularity | Six-segment Resource Description | IP Restriction |
|---|---|---|---|---|
| DescribeModel | Describe customiztion model | Resource level | qcs::asr::uin/${uin}:model/$modelId | not supported |
| DescribeUserInfo | Describe User Info | Resource level | qcs::asr::uin/${uin}:subUin/${subUin} | Supported |
| GetAsrKeyWordLibList | List asr keyword library | Resource level | qcs::asr::uin/$account:keyWordLib/$keyWordLibId qcs::asr::uin/${uin}:subUin/* |
Supported |
| GetAsrVocabList | Get asr vocab list | Resource level | qcs::asr::uin/$account:vocab/ qcs::asr::uin/${uin}:subUin/ |
Supported |
| GetCustomizationList | Get customization model list | Resource level | qcs::asr::uin/:model/${ModelId} | Supported |
| GetUsageByDate | get usage by date | Operation level | * | Supported |
Yes
No
Was this page helpful?